CVE-2023-47802

Опубликовано: 28 июн. 2024

Источник: nvd

CVSS3: 7.2

EPSS Низкий

Описание

A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP block functionality. This allows remote authenticated users with administrator privileges to execute arbitrary commands via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500.

Ссылки

https://www.synology.com/en-global/security/advisory/Synology_SA_23_15
Vendor Advisory
https://www.synology.com/en-global/security/advisory/Synology_SA_23_15
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:synology:bc500_firmware:*:*:*:*:*:*:*:*

Версия до 1.0.7-0298 (исключая)

cpe:2.3:h:synology:bc500:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:synology:tc500_firmware:*:*:*:*:*:*:*:*

Версия до 1.0.7-0298 (исключая)

cpe:2.3:h:synology:tc500:-:*:*:*:*:*:*:*

EPSS

Процентиль: 52%

0.00285

Низкий

7.2 High

CVSS3

Дефекты

CWE-78

Связанные уязвимости

GHSA-h7wv-22h8-mr42