CVE-2023-5746: Synology BC500 Firmware

Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days.

A vulnerability regarding use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.5-0185 may be affected: BC500 and TC500.

Affected products

• Synology BC500 Firmware: before 1.0.5-0185 (fixed in 1.0.5-0185)
• Synology TC500 Firmware: before 1.0.5-0185 (fixed in 1.0.5-0185)

Published 2023-10-25. Last modified 2026-06-17.