CVE-2024-39350

A vulnerability regarding authentication bypass by spoofing is found in the RTSP functionality. This allows man-in-the-middle attackers to obtain privileges without consent via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500.

• CWE-290

• https://www.synology.com/en-global/security/advisory/Synology_SA_23_15Vendor Advisory
• https://www.synology.com/en-global/security/advisory/Synology_SA_23_15Vendor Advisory

Published

Jun 28, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39344An issue was discovered in the Docusign API package 8.142.14…8.1
• CVE-2024-39345AdTran 834-5 HDC17600021F1 (SmartOS 11.1.1.1) devices enable…7.2
• CVE-2024-39347Incorrect default permissions vulnerability in firewall func…5.9
• CVE-2024-39348Download of code without integrity check vulnerability in Ai…7.5
• CVE-2024-39349A vulnerability regarding buffer copy without checking size …9.8
• CVE-2024-3935In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if …6.5
• CVE-2024-39351A vulnerability regarding improper neutralization of special…7.2
• CVE-2024-39352A vulnerability regarding incorrect authorization is found i…4.9
• CVE-2024-39353Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to sanitiz…2.7
• CVE-2024-39354If an attacker tricks a valid user into running Delta Electr…7.8
• CVE-2024-39355Improper handling of physical or environmental conditions in…6.5
• CVE-2024-39356NULL pointer dereference in some Intel(R) PROSet/Wireless Wi…7.4