Camera Firmware vulnerabilities

6 known vulnerabilities in Camera Firmware from Synology. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Camera Firmware: Out-of-bounds Read

  CVE-2024-11131Mar 19, 2025Synology

  A vulnerability regarding out-of-bounds read is found in the video interface. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.2.0-0525 may be affected: BC500,

• 7.5 High severity

  Camera Firmware: Authentication Bypass by Spoofing

  CVE-2024-39350Jun 28, 2024Synology

  A vulnerability regarding authentication bypass by spoofing is found in the RTSP functionality. This allows man-in-the-middle attackers to obtain privileges without consent via unspecified vectors. The following models with Synology Camera Firmware versions be

• 7.2 High severity

  Camera Firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-39351Jun 28, 2024SynologyEPSS 1.55%

  A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the NTP configuration. This allows remote authenticated users with administrator privileges to execute arbitrary commands via unspe

• 9.8 Critical severity

  Camera Firmware: Buffer Copy without Checking Size of Input

  CVE-2024-39349Jun 28, 2024SynologyEPSS 1.44%

  A vulnerability regarding buffer copy without checking size of input ('Classic Buffer Overflow') is found in the libjansson component and it does not affect the upstream library. This allows remote attackers to execute arbitrary code via unspecified vectors. T

• 7.2 High severity

  Camera Firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-47802Jun 28, 2024SynologyEPSS 1.46%

  A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP block functionality. This allows remote authenticated users with administrator privileges to execute arbitrary commands via

• 9.8 Critical severity

  Camera Firmware: Use of Externally-Controlled Format String

  CVE-2023-5746Oct 25, 2023SynologyEPSS 2.25%

  A vulnerability regarding use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.5-0185 ma