Skip to main content

Surveillance Station CVE-2024-29231

MEDIUM
Improper Validation of Array Index (CWE-129)
2024-03-28 security@synology.com
Information Disclosure Synology Surveillance Station
5.4
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.4 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
Low

Lifecycle Timeline

1
CVE Published
Mar 28, 2024 - 07:16 nvd
MEDIUM 5.4

DescriptionNVD

Improper validation of array index vulnerability in UserPrivilege.Enum webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.

AnalysisAI

Improper validation of array index vulnerability in UserPrivilege.Enum webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-129. Improper validation of array index vulnerability in UserPrivilege.Enum webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors. Affected products include: Synology Surveillance Station. Version information: before 9.2.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Surveillance Station

View all
CVE-2024-29241 CRITICAL
9.9 Mar 28

Missing authorization vulnerability in System webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.
CVE-2021-38687 CRITICAL
9.8 Dec 29

A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Surveillance Station. Rated critical

CVE-2021-28797 CRITICAL
9.8 Apr 14

A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. R
CVE-2024-29229 HIGH
7.7 Mar 28

Missing authorization vulnerability in GetLiveViewPath webapi component in Synology Surveillance Station before 9.2.0-92
CVE-2024-29228 HIGH
7.7 Mar 28

Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289
CVE-2024-29239 MEDIUM
5.4 Mar 28

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Recording.CountByC
CVE-2024-29238 MEDIUM
5.4 Mar 28

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log.CountByCategor
CVE-2024-29237 MEDIUM
5.4 Mar 28

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in ActionRule.Delete

CVE-2024-29236 MEDIUM
5.4 Mar 28

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in AudioPattern.Delet
CVE-2024-29235 MEDIUM
5.4 Mar 28

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in IOModule.EnumLog w
CVE-2024-29234 MEDIUM
5.4 Mar 28

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Group.Save webapi

CVE-2024-29233 MEDIUM
5.4 Mar 28

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Emap.Delete webapi

Same weakness CWE-129 – Improper Validation of Array Index

View all
CVE-2016-9053 CRITICAL POC
9.8
CVE-2020-27485 CRITICAL POC
9.9
CVE-2020-27483 CRITICAL POC
9.9
CVE-2024-24563 CRITICAL POC
9.8
CVE-2017-8797 HIGH
7.5
CVE-2018-11489 HIGH POC
8.8
CVE-2026-56770 HIGH POC
8.7
CVE-2017-7228 HIGH POC
8.2

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2024-29231 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy