Vulnerabilities > CVE-2024-39352 - Incorrect Authorization vulnerability in Synology Bc500 Firmware and Tc500 Firmware

CVSS 4.9 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

HIGH

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

synology

CWE-863

NVD

Published: 2024-06-28

Updated: 2025-04-10

Summary

A vulnerability regarding incorrect authorization is found in the firmware upgrade functionality. This allows remote authenticated users with administrator privileges to bypass firmware integrity check via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500.

Vulnerable Configurations

Part	Description	Count
OS	Synology Synology Bc500 Firmware - Synology Bc500 Firmware 1.0.4-0182 Synology Bc500 Firmware 1.0.5-0185 Synology Bc500 Firmware 1.0.6-0290 Synology Bc500 Firmware 1.0.6-0294 Synology Tc500 Firmware - Synology Tc500 Firmware 1.0.2-0142 Synology Tc500 Firmware 1.0.4-0182 Synology Tc500 Firmware 1.0.5-0185 Synology Tc500 Firmware 1.0.6-0290 Synology Tc500 Firmware 1.0.6-0294	11
Hardware	Synology Synology Bc500 - Synology Tc500 -	2

Common Weakness Enumeration (CWE)

CWE-863 - Incorrect Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References