CVE-2024-47268: Synology Surveillance Station Flaw

CVE-2024-47268 Overview

CVE-2024-47268 is a missing authorization vulnerability [CWE-862] in the AddOns functionality of Synology Surveillance Station. The flaw allows remote authenticated users holding administrator privileges to obtain sensitive information through unspecified vectors. Synology addressed the issue in Surveillance Station versions 9.2.2-11575 and 9.2.2-9575. The vulnerability requires high privileges and network access but no user interaction, and it affects confidentiality without impacting integrity or availability.

Critical Impact

Administrator-level attackers can extract sensitive information from Surveillance Station deployments by abusing missing authorization checks in the AddOns component.

Affected Products

• Synology Surveillance Station versions prior to 9.2.2-11575
• Synology Surveillance Station versions prior to 9.2.2-9575
• Synology DiskStation Manager (DSM) deployments running vulnerable Surveillance Station packages

Discovery Timeline

• 2026-05-27 - CVE-2024-47268 published to the National Vulnerability Database (NVD)
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2024-47268

Vulnerability Analysis

The vulnerability resides in the AddOns functionality of Synology Surveillance Station. The component fails to perform proper authorization checks before exposing sensitive resources. An attacker who is already authenticated to the application with administrator privileges can leverage this gap to retrieve information that should be restricted by the application's access control model.

The issue is classified under CWE-862: Missing Authorization. Although administrator credentials are required for exploitation, the flaw still represents a meaningful security boundary violation. In multi-tenant or delegated-administration environments, administrators of one scope should not gain access to data outside their authorized boundaries.

Exploitation does not require user interaction, the attack complexity is low, and the scope is unchanged. Confidentiality impact is high, while integrity and availability remain unaffected.

Root Cause

The root cause is the absence of an authorization check inside the AddOns code path. The application validates that the caller is authenticated, but does not enforce the additional permission required to read the protected resource. As a result, any administrator session can reach data the application logic intended to restrict.

Attack Vector

The attack vector is network-based. An attacker first authenticates to Surveillance Station with administrator credentials, then issues requests against the AddOns endpoints. Because the server omits the required authorization decision, the response returns sensitive information that the attacker would otherwise be unable to retrieve. The Synology advisory does not publicly disclose the specific endpoints or parameters involved.

No public proof-of-concept or exploit code is available. The vulnerability is described in prose by the vendor without further technical details. See the Synology Security Advisory SA-24-25 for the official description.

Detection Methods for CVE-2024-47268

Indicators of Compromise

• Unexpected administrator-initiated requests to Surveillance Station AddOns endpoints outside normal change windows.
• Surveillance Station audit log entries showing AddOns enumeration or configuration reads from unfamiliar source IP addresses.
• Administrator account logins from geographies or networks that do not match the operator's expected access patterns.

Detection Strategies

• Compare installed Surveillance Station package versions against the fixed builds 9.2.2-11575 and 9.2.2-9575 and flag any host running an earlier version.
• Review web-server and application logs for HTTP requests targeting AddOns-related paths from administrator sessions, correlating with session origin and timing.
• Alert on changes to administrator accounts, password resets, or new administrator creation immediately prior to AddOns activity.

Monitoring Recommendations

• Forward Synology DSM and Surveillance Station logs to a central log platform and retain them long enough to support retrospective investigation.
• Baseline normal administrator activity in Surveillance Station and alert on deviations such as off-hours access or anomalous request volumes.
• Monitor for credential reuse and brute-force attempts against Surveillance Station administrator accounts, since exploitation requires valid administrator credentials.

How to Mitigate CVE-2024-47268

Immediate Actions Required

• Upgrade Surveillance Station to version 9.2.2-11575 or 9.2.2-9575 or later, depending on the DSM release in use.
• Rotate Surveillance Station administrator credentials and enforce multi-factor authentication on all privileged accounts.
• Audit the list of accounts holding administrator privileges and remove any that are no longer required.

Patch Information

Synology released fixed builds of Surveillance Station that introduce the missing authorization check. Administrators should install Surveillance Station 9.2.2-11575 or 9.2.2-9575, matching the DSM major version in their environment. Refer to the Synology Security Advisory SA-24-25 for vendor-confirmed fixed versions and download guidance.

Workarounds

• Restrict network access to Surveillance Station management interfaces to trusted administrative networks using firewall or DSM access-control rules.
• Disable or remove Surveillance Station administrator accounts that are not actively required until the patch is applied.
• Place Surveillance Station behind a VPN or reverse proxy that enforces additional authentication controls.

# Configuration example: restrict Surveillance Station access at the network layer
# Replace 192.0.2.0/24 with the administrative network you trust
iptables -A INPUT -p tcp --dport 9900 -s 192.0.2.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9900 -j DROP