CVE-2024-39349

EUVD-2024-37912
A vulnerability regarding buffer copy without checking size of input ('Classic Buffer Overflow') is found in the libjansson component and it does not affect the upstream library. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500.
Classic Buffer Overflow
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
Affected Products (NVD)
VendorProductVersion
synologybc500_firmware
𝑥
< 1.0.7-0298
synologytc500_firmware
𝑥
< 1.0.7-0298
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
synologycamera_firmware
1.0 ≤
𝑥
< 1.0.7-0298
ADP
Common Weakness Enumeration
References
https://www.synology.com/en-global/security/advisory/Synology_SA_23_15
https://www.synology.com/en-global/security/advisory/Synology_SA_23_15