High severity · published Jun 28, 2024
CVE-2024-39351
A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the NTP configuration
7.2
CVSS
1.5%
EPSS
No
On KEV
Description
A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the NTP configuration. This allows remote authenticated users with administrator privileges to execute arbitrary commands via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Bc500 Firmware · Synology
before 1.0.7-0298 · source: NVD
TF
Tc500 Firmware · Synology
before 1.0.7-0298 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39351
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-39351
Vendor Advisory
https://www.synology.com/en-global/security/advisory/Synology_SA_23_15
More from Bc500 Firmware
9.8
CVE-2024-11131
A vulnerability regarding out-of-bounds read is found in the video interface
9.8
CVE-2024-39349
A vulnerability regarding buffer copy without checking size of input ('Classic Buffer Overflow') is found in the libjansson component and it does not affect the upstream library
9.8
CVE-2023-5746
A vulnerability regarding use of externally-controlled format string is found in the cgi component
7.5
CVE-2024-39350
A vulnerability regarding authentication bypass by spoofing is found in the RTSP functionality
7.2
CVE-2023-47802
A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP block functionality