CVE-2023-47802 is an OS command injection flaw in the IP block feature of Synology BC500 and TC500 cameras. NVD scores it 7.2, High, and the attacker needs administrator privileges. Synology's advisory says to upgrade the camera firmware to 1.0.7-0298 or later. It lists no mitigation.
What's affected
Synology's advisory SA-23-15 lists the BC500 and TC500 cameras with firmware before 1.0.7-0298 as affected, and gives 1.0.7-0298 or above as the fix. Mitigation is listed as none. The advisory says the vulnerabilities were reported by Pwn2Own 2023.
Source note on severity: the advisory covers several CVEs at once and rates the advisory as a whole Critical, because one of them, CVE-2024-39349, scores 9.8. For this CVE alone, Synology rates it Important with a CVSS3 base score of 7.2, the same as NVD's 7.2, High. So there is no disagreement on this CVE, only a wider headline on the page.
The weakness is CWE-78, OS command injection. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, with High privileges required. The advisory says remote authenticated users with administrator privileges could run arbitrary commands via unspecified vectors.
How to check if you're exposed
Open the camera's web interface or the Surveillance Station device list and read the firmware version for each BC500 and TC500. Anything below 1.0.7-0298 needs the update.
Cameras are easy to lose track of. Count how many units you have, where they are, and who holds the administrator password. Because the attack needs administrator rights, the strength and secrecy of that password is part of the defence.
What to do now
- Update every BC500 and TC500 to firmware 1.0.7-0298 or later, using Synology's update process for the cameras.
- Change the camera administrator passwords to unique, strong values.
- Keep the cameras on a separate network segment from your main systems, and off the public internet.
- Note that the same firmware update covers the other CVEs on Synology's page, including the 9.8 buffer overflow.
- Record the camera firmware versions in your asset inventory.
Why it matters
Command injection, CWE-78, means a feature that handles input, here the IP block function, passes that input into an operating system command without removing characters that change its meaning. On a camera, the operating system is a small Linux device that often has network access to more than you would expect.
The administrator requirement lowers the score from the 9.8 range to 7.2. It does not remove the risk. Administrator passwords on devices are often shared, weak or left at a default, and the camera is a place where an attacker can sit unseen for a long time.
The advisory's other flaws in the same firmware make the update more urgent than this one score suggests. A buffer overflow in a bundled library rates 9.8, with no privileges needed, and the same upgrade fixes it. Read the whole advisory, not only the CVE you came for.
Quick check
Is there a workaround?
Synology lists mitigation as none.
Why does the advisory say Critical?
The advisory covers several CVEs, and the highest, CVE-2024-39349, is rated Critical. This CVE is rated Important.
Sources
Last reviewed: 19 October 2026.
