CVE-2023-5746 - OpenCVE

A vulnerability regarding use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.5-0185 may be affected: BC500 and TC500.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Synology	Bc500 Bc500 Firmware Tc500 Tc500 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:synology:bc500_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:synology:bc500:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:synology:tc500_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:synology:tc500:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.synology.com/en-global/security/advisory/Synology_SA_23_11

History

No history.

MITRE

Status: PUBLISHED

Assigner: synology

Published: 2023-10-24T07:32:14.184Z

Updated: 2024-09-12T14:33:52.546Z

Reserved: 2023-10-24T02:48:16.801Z

Link: CVE-2023-5746

Vulnrichment

Updated: 2024-08-02T08:07:32.655Z

NVD

Status : Modified

Published: 2023-10-25T18:17:44.770

Modified: 2023-11-07T04:24:19.560

Link: CVE-2023-5746

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-5746", "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01", "state": "PUBLISHED", "assignerShortName": "synology", "dateReserved": "2023-10-24T02:48:16.801Z", "datePublished": "2023-10-24T07:32:14.184Z", "dateUpdated": "2024-09-12T14:33:52.546Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-134: Use of Externally-Controlled Format String"}]}], "affected": [{"vendor": "Synology", "product": "Camera Firmware", "versions": [{"version": "1.0", "status": "affected", "lessThan": "1.0.5-0185", "versionType": "semver"}], "defaultStatus": "affected", "platforms": ["BC500", "TC500"]}], "descriptions": [{"lang": "en", "value": "A vulnerability regarding use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.5-0185 may be affected: BC500 and TC500."}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "references": [{"url": "https://www.synology.com/en-global/security/advisory/Synology_SA_23_11", "name": "Synology-SA-23:11 Synology Camera", "tags": ["vendor-advisory"]}], "credits": [{"lang": "en", "value": "chumen77(GAO JUYANG) from WeBin Lab of DbappSecurity Co.,Ltd.", "type": "finder"}], "providerMetadata": {"orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01", "shortName": "synology", "dateUpdated": "2023-10-24T10:24:05.921Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:07:32.655Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.synology.com/en-global/security/advisory/Synology_SA_23_11", "name": "Synology-SA-23:11 Synology Camera", "tags": ["vendor-advisory", "x_transferred"]}]}, {"affected": [{"vendor": "synology", "product": "camera_firmware", "cpes": ["cpe:2.3:a:synology:camera_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.0.5-0185", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-09T20:00:45.716483Z", "id": "CVE-2023-5746", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T14:33:52.546Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.synology.com/en-global/security/advisory/Synology_SA_23_11", "name": "Synology-SA-23:11 Synology Camera", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:07:32.655Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-5746", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-09T20:00:45.716483Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:synology:camera_firmware:*:*:*:*:*:*:*:*"], "vendor": "synology", "product": "camera_firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.5-0185", "versionType": "semver"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-09T20:00:19.868Z"}}], "cna": {"credits": [{"lang": "en", "type": "finder", "value": "chumen77(GAO JUYANG) from WeBin Lab of DbappSecurity Co.,Ltd."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Synology", "product": "Camera Firmware", "versions": [{"status": "affected", "version": "1.0", "lessThan": "1.0.5-0185", "versionType": "semver"}], "platforms": ["BC500", "TC500"], "defaultStatus": "affected"}], "references": [{"url": "https://www.synology.com/en-global/security/advisory/Synology_SA_23_11", "name": "Synology-SA-23:11 Synology Camera", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "A vulnerability regarding use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.5-0185 may be affected: BC500 and TC500."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-134: Use of Externally-Controlled Format String"}]}], "providerMetadata": {"orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01", "shortName": "synology", "dateUpdated": "2023-10-24T10:24:05.921Z"}}}, "cveMetadata": {"cveId": "CVE-2023-5746", "state": "PUBLISHED", "dateUpdated": "2024-09-12T14:33:52.546Z", "dateReserved": "2023-10-24T02:48:16.801Z", "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01", "datePublished": "2023-10-24T07:32:14.184Z", "assignerShortName": "synology"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:synology:bc500_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "606E80D6-82AA-42EB-AD3F-DFB34847F7E4", "versionEndExcluding": "1.0.5-0185", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:synology:bc500:-:*:*:*:*:*:*:*", "matchCriteriaId": "5FD618BD-29BD-4F43-9BEF-F73065247580", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:synology:tc500_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "18086F22-1F7B-4B3D-BF18-DFA3B0DD6783", "versionEndExcluding": "1.0.5-0185", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:synology:tc500:-:*:*:*:*:*:*:*", "matchCriteriaId": "582C2C89-3351-4DC6-B40A-7E2E4CA6AFEA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability regarding use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.5-0185 may be affected: BC500 and TC500."}, {"lang": "es", "value": "Se encuentra una vulnerabilidad relacionada con el uso de cadenas de formato controladas externamente en el componente cgi. Esto permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de vectores no especificados. Los siguientes modelos con versiones de Synology Camera Firmware anteriores a 1.0.5-0185 pueden verse afectados: BC500 y TC500."}], "id": "CVE-2023-5746", "lastModified": "2023-11-07T04:24:19.560", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@synology.com", "type": "Secondary"}]}, "published": "2023-10-25T18:17:44.770", "references": [{"source": "security@synology.com", "tags": ["Vendor Advisory"], "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_23_11"}], "sourceIdentifier": "security@synology.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-134"}], "source": "nvd@nist.gov", "type": "Primary"}]}