CVE-2023-47802

HIGH

Synology BC500 and TC500 Firmware < 1.0.7-0298 - Authenticated OS Command Injection in IP Block Functionality

Title source: llm
STIX 2.1

Description

A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP block functionality. This allows remote authenticated users with administrator privileges to execute arbitrary commands via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500.

References (1)

Core 1
Core References

Scores

CVSS v3 7.2
EPSS 0.0029
EPSS Percentile 52.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (2)
synology/bc500_firmware < 1.0.7-0298
synology/tc500_firmware < 1.0.7-0298
Published Jun 28, 2024
Tracked Since Feb 18, 2026