CVE-2024-39351

HIGH

Synology BC500 and TC500 Firmware < 1.0.7-0298 - Authenticated OS Command Injection via NTP Configuration

Title source: llm
STIX 2.1

Description

A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the NTP configuration. This allows remote authenticated users with administrator privileges to execute arbitrary commands via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500.

References (1)

Core 1
Core References

Scores

CVSS v3 7.2
EPSS 0.0060
EPSS Percentile 69.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (2)
synology/bc500_firmware < 1.0.7-0298
synology/tc500_firmware < 1.0.7-0298
Published Jun 28, 2024
Tracked Since Feb 18, 2026