Medium · 4.3 CVE-2024-29240 EUVD-2024-26254GHSA-fp3v-8f7x-27x6

Missing authorization vulnerability in LayoutSave webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allow…

Published Mar 28, 2024 · Updated Aug 1, 2025 · Assigned by synology

Vendor: Synology Product: Surveillance Station

Description

Missing authorization vulnerability in LayoutSave webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to conduct limited denial-of-service attacks via unspecified vectors.

Affected products

Vendor	Product	Affected	Fixed
Synology	Surveillance Station	< 9.2.0-9289, < 9.2.0-11289	9.2.0-9289

References

Synology-SA-24:04 Surveillance Station vendor-advisory