The vulnerability is an insufficiently protected credentials flaw in the IPSpeaker component of Synology Surveillance Station versions earlier than 9.2.2-11575 and 9.2.2-9575. An authenticated user with administrator privileges can obtain sensitive information, leading to potential exposure of system configuration or user data. The weakness is a credential management issue classified as CWE‑522.

Synology Surveillance Station, specifically the IPSpeaker component on releases before 9.2.2-11575 and 9.2.2-9575.

The CVSS score of 4.9 indicates moderate severity, and the EPSS score is not available, so the likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires an attacker to be an authenticated administrator, which limits exposure to compromised or mis‑managed accounts. The potential impact is limited to data disclosure rather than system takeover.