CVE-2024-29229

Summary

CVE-2024-29229 is a missing authorization vulnerability affecting the GetLiveViewPath webapi component in Synology Surveillance Station versions prior to 9.2.0-9289 and 9.2.0-11289. This issue enables remote, authenticated users to access sensitive information through unspecified vectors, bypassing necessary authorization checks. The consequences of exploiting this vulnerability could result in unauthorized access to critical system data, potentially leading to privacy breaches or further unintended system manipulation. Synology strongly advises users to upgrade to the latest version of Surveillance Station to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.