This vulnerability in Synology Surveillance Station affects the Export Key functionality by transmitting sensitive information in cleartext. Remote attackers with administrator privileges can exploit this to access sensitive data. The issue exists in versions before 9.2.2-11575 and 9.2.2-9575. The CVSS 3.1 base score is 4.9, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No vendor advisory or patch information is currently available, and the product is not a cloud service.

An attacker with administrator privileges on the affected Synology Surveillance Station can obtain sensitive information transmitted in cleartext via the Export Key functionality. This could lead to confidentiality breaches. There is no indication of impact on integrity or availability. The vulnerability requires authenticated access with high privileges, limiting the attack surface. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted personnel only and monitor for unusual activity related to the Export Key functionality. Avoid transmitting sensitive information over untrusted networks where possible.