CVE-2023-5746

CRITICAL

Synology Bc500 Firmware < 1.0.5-0185 - Format String Vulnerability

Title source: rule
STIX 2.1

Description

A vulnerability regarding use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.5-0185 may be affected: BC500 and TC500.

References (1)

Scores

CVSS v3 9.8
EPSS 0.0589
EPSS Percentile 90.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-134
Status published
Products (2)
synology/bc500_firmware < 1.0.5-0185
synology/tc500_firmware < 1.0.5-0185
Published Oct 25, 2023
Tracked Since Feb 18, 2026