Team82 RCE Attack on Synology BC500 Camera

Team82 demonstrates a Remote Code Execution exploit against Synology BC500 IP cameras via lateral network pivoting.

This demo is a proof-of-concept attack developed by Team82 exploiting a remote code execution (RCE) vulnerability in Synology BC500 IP cameras.

The attack is part of a broader research project that involved first exploiting a perimeter router and pivoting across the local network to compromise surveillance cameras and internal XIoT devices.

Key research highlights:

• Remote Code Execution (RCE) vulnerability analysis on Synology BC500 IP cameras

• Demonstration of WAN-to-LAN lateral movement and device pivoting

• Risks of compromised physical security and surveillance infrastructure

• Mitigation recommendations for camera firmware and network isolation