CVE-2024-29240

Published: Mar 28, 2024Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Missing authorization vulnerability in LayoutSave webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to conduct limited denial-of-service attacks via unspecified vectors.

Affected (2)

Products: Synology: Surveillance Station

Synology

1 product

Surveillance Station

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Synology Surveillance Station	Before 9.2.0-9289

Running on/with	Platform Versions
Synology Diskstation Manager	Version 6.2

Configuration B

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Synology Surveillance Station	Before 9.2.0-11289

Running on/with	Platform Versions
Synology Diskstation Manager	Version 7.1
Synology Diskstation Manager	Version 7.2

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://www.synology.com/en-global/security/advisory/Synology_SA_24_04

Source: security@synology.com

Vendor Advisory

https://www.synology.com/en-global/security/advisory/Synology_SA_24_04

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.