CVE-2024-29241

Published: Mar 28, 2024Modified: Jun 17, 2026

9.9

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

Exploitability: 3.1 / Impact: 6.0

Source: NVD

Description

Missing authorization vulnerability in System webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain non-sensitive information, write sensitive configurations in DSM, and reboot or shutdown NAS via unspecified vectors.

Affected (2)

Products: Synology: Surveillance Station

1 product

Surveillance Station

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Synology Surveillance Station	Before 9.2.0-9289

Running on/with	Platform Versions
Synology Diskstation Manager	Version 6.2

Configuration B

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Synology Surveillance Station	Before 9.2.0-11289

Running on/with	Platform Versions
Synology Diskstation Manager	Version 7.1
Synology Diskstation Manager	Version 7.2

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://www.synology.com/en-global/security/advisory/Synology_SA_24_04

Source: security@synology.com

Vendor Advisory

https://www.synology.com/en-global/security/advisory/Synology_SA_24_04

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.