CVE-2024-29241: Synology Surveillance Station Auth Bypass

CVE-2024-29241 Overview

CVE-2024-29241 is a missing authorization vulnerability in the System webapi component of Synology Surveillance Station. The flaw affects versions before 9.2.0-9289 and 9.2.0-11289. Authenticated remote users can obtain non-sensitive information, write sensitive configurations in DiskStation Manager (DSM), and reboot or shut down the underlying Network Attached Storage (NAS) device. The weakness is classified under [CWE-862: Missing Authorization]. The issue is tracked in Synology Security Advisory SA-24-04.

Critical Impact
Authenticated attackers can modify DSM configurations and forcibly reboot or shut down the NAS, disrupting all hosted services and surveillance recording.

Affected Products

Synology Surveillance Station versions before 9.2.0-9289
Synology Surveillance Station versions before 9.2.0-11289
Synology DiskStation Manager (DSM) 6.2, 7.1, and 7.2

Discovery Timeline

2024-03-28 - CVE-2024-29241 published to the National Vulnerability Database (NVD)
2025-08-12 - Last updated in NVD database

Technical Details for CVE-2024-29241

Vulnerability Analysis

The vulnerability resides in the System webapi component of Synology Surveillance Station. Specific API endpoints fail to enforce authorization checks on the calling user's privilege level. Any authenticated session, regardless of role, can invoke privileged operations exposed by these endpoints. The impact crosses a trust boundary because the affected component executes actions against DSM, the host operating system. As a result, a low-privileged Surveillance Station user can manipulate DSM configuration and control the physical state of the NAS.

Root Cause

The root cause is a missing authorization check [CWE-862] in the System webapi handlers. The application authenticates the request but does not verify that the authenticated principal holds the role required for the requested action. Privileged operations such as configuration writes and power-state changes are exposed to all authenticated users.

Attack Vector

Exploitation requires network access to the Surveillance Station web interface and valid credentials with low privileges. The attacker issues crafted requests to the unprotected System webapi endpoints. The vendor advisory does not disclose the specific request structure. Successful requests allow the attacker to read non-sensitive data, write DSM configuration values, or trigger a reboot or shutdown.

No verified public proof-of-concept code is available. Refer to the Synology Security Advisory SA-24-04 for vendor technical context.

Detection Methods for CVE-2024-29241

Indicators of Compromise

Unscheduled NAS reboot or shutdown events recorded in DSM system logs
Surveillance Station webapi requests from low-privileged accounts targeting system or power-control endpoints
Unexpected modifications to DSM configuration files or settings outside administrative change windows
Authentication events for non-administrative users immediately preceding privileged DSM actions

Detection Strategies

Compare the Surveillance Station version reported by DSM against 9.2.0-9289 and 9.2.0-11289 to identify vulnerable installations
Audit DSM and Surveillance Station webapi access logs for HTTP requests to system control endpoints originating from non-admin user IDs
Correlate Surveillance Station session activity with DSM reboot, shutdown, and configuration change events

Monitoring Recommendations

Forward DSM and Surveillance Station logs to a centralized SIEM or data lake for retention and correlation
Alert on any reboot or shutdown event that is not preceded by an administrative session
Track configuration changes to DSM through file integrity monitoring on the NAS configuration store

How to Mitigate CVE-2024-29241

Immediate Actions Required

Update Synology Surveillance Station to version 9.2.0-9289 or 9.2.0-11289 or later as specified by DSM platform
Restrict Surveillance Station web interface exposure to trusted internal networks only
Review and reduce the number of Surveillance Station user accounts, removing unused or shared logins
Rotate credentials for all Surveillance Station accounts after patching

Patch Information

Synology has released fixed builds for Surveillance Station. Install Surveillance Station 9.2.0-9289 or 9.2.0-11289 or later through the DSM Package Center. Patch availability and version mapping per DSM release are documented in Synology Security Advisory SA-24-04.

Workarounds

Block external access to DSM and Surveillance Station web ports at the perimeter firewall until the patch is applied
Require VPN access for all Surveillance Station administration
Disable the Surveillance Station package on NAS devices that do not actively require it

bash

# Verify installed Surveillance Station version on DSM via SSH
synopkg version SurveillanceStation

# Trigger package update check from DSM CLI
sudo synopkg checkupdate SurveillanceStation
sudo synopkg install_from_server SurveillanceStation