CVE-2024-11131
Published: 19 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2024-11131 is an out-of-bounds read vulnerability (CWE-125) in the video interface of Synology Camera Firmware. It affects the BC500, CC400W, and TC500 models running versions prior to 1.2.0-0525. Published on 2025-03-19, the flaw has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and enables remote attackers to execute arbitrary code via unspecified vectors.
Remote, unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and without requiring user interaction. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, allowing arbitrary code execution on affected devices.
Synology Security Advisory SA_24_24 details mitigation, with the vulnerability fixed in firmware version 1.2.0-0525. Affected users should update to this version or later; see https://www.synology.com/en-global/security/advisory/Synology_SA_24_24 for full guidance.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Out-of-bounds read in public-facing video interface enables remote unauthenticated RCE on camera firmware, directly mapping to exploitation of public-facing applications.