Skip to main content

Surveillance Station CVE-2024-29228

HIGH
Missing Authorization (CWE-862)
2024-03-28 security@synology.com
Authentication Bypass Synology Surveillance Station
7.7
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.7 HIGH
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Mar 28, 2024 - 07:16 nvd
HIGH 7.7

DescriptionNVD

Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain sensitive information via unspecified vectors.

AnalysisAI

Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain sensitive. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Missing Authorization (CWE-862), which allows attackers to access resources or perform actions without proper authorization checks. Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain sensitive information via unspecified vectors. Affected products include: Synology Surveillance Station. Version information: before 9.2.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement role-based access control, validate authorization on every request server-side, apply principle of least privilege.

More in Surveillance Station

View all
CVE-2024-29241 CRITICAL
9.9 Mar 28

Missing authorization vulnerability in System webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.
CVE-2021-38687 CRITICAL
9.8 Dec 29

A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Surveillance Station. Rated critical

CVE-2021-28797 CRITICAL
9.8 Apr 14

A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. R
CVE-2024-29229 HIGH
7.7 Mar 28

Missing authorization vulnerability in GetLiveViewPath webapi component in Synology Surveillance Station before 9.2.0-92
CVE-2024-29239 MEDIUM
5.4 Mar 28

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Recording.CountByC
CVE-2024-29238 MEDIUM
5.4 Mar 28

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log.CountByCategor
CVE-2024-29237 MEDIUM
5.4 Mar 28

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in ActionRule.Delete

CVE-2024-29236 MEDIUM
5.4 Mar 28

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in AudioPattern.Delet
CVE-2024-29235 MEDIUM
5.4 Mar 28

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in IOModule.EnumLog w
CVE-2024-29234 MEDIUM
5.4 Mar 28

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Group.Save webapi

CVE-2024-29233 MEDIUM
5.4 Mar 28

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Emap.Delete webapi
CVE-2024-29232 MEDIUM
5.4 Mar 28

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Alert.Enum webapi

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2025-20362 MEDIUM POC
6.5
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2024-29228 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy