ZDI-CAN-25538: ZDI-25-216: (Pwn2Own) Synology TC500 ONVIF Heap-based Buffer Overflow Remote Code Execution Vulnerability

Published Apr 9, 2025

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology TC500 cameras. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2024-11131.

Affected Software

1 affected component

Synology TC500

Event History

Apr 9, 2025

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-25538?

The severity of ZDI-CAN-25538 is rated at 8.8 according to the CVSS scale.

How do I fix ZDI-CAN-25538?

To fix ZDI-CAN-25538, users should update their Synology TC500 cameras to the latest firmware released by Synology.

Who is affected by ZDI-CAN-25538?

ZDI-CAN-25538 affects installations of Synology TC500 cameras that are exposed to network-adjacent attackers.

Is authentication required to exploit ZDI-CAN-25538?

No, authentication is not required to exploit the vulnerability identified as ZDI-CAN-25538.

What type of attack can be executed via ZDI-CAN-25538?

ZDI-CAN-25538 allows network-adjacent attackers to execute arbitrary code on affected installations of Synology TC500 cameras.