Synology BC500 Firmware vulnerabilities

9 CVEs affecting Synology BC500 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-11131, published 2025-03-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-5746, published 2023-10-25. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability regarding use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute arbitrary code via unspecified vectors. The following…
CVE-2024-39351, published 2024-06-28. High severity, CVSS 7.2. EPSS: 1.5% chance of exploitation in the next 30 days. A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the NTP configuration. This allows remote authenticated users with…
CVE-2023-47802, published 2024-06-28. High severity, CVSS 7.2. EPSS: 1.5% chance of exploitation in the next 30 days. A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP block functionality. This allows remote authenticated users…
CVE-2024-39349, published 2024-06-28. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. A vulnerability regarding buffer copy without checking size of input ('Classic Buffer Overflow') is found in the libjansson component and it does not affect the upstream library. This allows remote…
CVE-2024-39352, published 2024-06-28. Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability regarding incorrect authorization is found in the firmware upgrade functionality. This allows remote authenticated users with administrator privileges to bypass firmware integrity…
CVE-2024-11131, published 2025-03-19. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability regarding out-of-bounds read is found in the video interface. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera…
CVE-2023-47803, published 2024-06-28. Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability regarding improper limitation of a pathname to a restricted directory ('Path Traversal') is found in the Language Settings functionality. This allows remote attackers to read specific…
CVE-2024-39350, published 2024-06-28. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability regarding authentication bypass by spoofing is found in the RTSP functionality. This allows man-in-the-middle attackers to obtain privileges without consent via unspecified vectors.…
CVE-2024-5463, published 2024-06-04. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability regarding buffer copy without checking the size of input ('Classic Buffer Overflow') has been found in the login component. This allows remote attackers to write specific files…