CVE-2024-29237

Summary

CVE-2024-29237 is an SQL injection vulnerability affecting the ActionRule.Delete component in Synology Surveillance Station versions before 9.2.0-11289 and 9.2.0-9289. This issue permits remote, authenticated users to inject malicious SQL commands, potentially leading to unauthorized data access or modification. The flaw is caused by insufficient neutralization of special characters used in SQL commands. Users are advised to update their Surveillance Station software to the latest version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.