A sudo bug is a camera bug: component vulnerabilities in video devices

CVE-2021-3156, the sudo heap overflow known as Baron Samedit, is recorded in NVD against the Synology VS960HD and has been in CISA's Known Exploited Vulnerabilities catalogue since April 2022. The catalogue files it under the vendor name "Sudo", so camera-vendor filters do not return it.

The defect#

CVE-2021-3156 is an off-by-one in sudo's sudoers policy code, classed CWE-193. In shell mode, the loop that copies command-line arguments mishandles an argument ending in a single backslash: it reads past the end of that argument and copies what follows into a heap buffer never sized for it. sudoedit -s reaches the vulnerable path before privileges are dropped, so the overflow occurs in a root context. NVD's description is one sentence and gives the range as "Sudo before 1.9.5p2".

Qualys found the bug and published more. Its advisory to oss-security on 26 January 2021 names it Baron Samedit, states it "was introduced in July 2011 (commit 8255ed69)", and puts the affected range at "all legacy versions from 1.8.2 to 1.8.31p2 and all stable versions from 1.9.0 to 1.9.5p1". Fixed in 1.9.5p2.

NVD's CPE configuration for this CVE lists the Synology VS960HD alongside the Linux distributions.

Attacker prerequisites#

The vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — 7.8 HIGH, scored by [email protected]. AV:L sets a sequencing requirement: something else has to be executing on the box first. After that the requirement is close to nothing. Qualys' advisory states the bug "is exploitable by any local user (normal users and system users, sudoers and non-sudoers), without authentication", and reports "full root privileges on Ubuntu 20.04 (Sudo 1.8.31), Debian 10 (Sudo 1.8.27), and Fedora 33 (Sudo 1.9.2)" — general-purpose distributions in Qualys' own lab. Nothing in these sources shows the exploit run against VS960HD firmware, and nothing records whether that firmware exposes a reachable sudoedit to an unprivileged process.

First-stage access to a sealed appliance normally comes from one of three routes: an SSH credential left at its factory value or shared across the fleet; a diagnostic shell switched on at commissioning and never switched off; or a command injection in the web UI, executing as the low-privilege web account. The third route changes triage elsewhere. A web-tier bug that yields only the low-privilege web account is often rated low impact; a local privilege escalation on the same box removes that mitigation.

Impact and blast radius#

Everything in this section is general to Linux-based recorders. None of it is recorded for the VS960HD specifically — these sources contain no teardown of that firmware, and the reasoning below is architectural inference, not a finding.

S:U confines the impact to the vulnerable component's own security scope. On a recorder that scope carries more than the metric implies, because of what the box has to hold to do its job. A recorder authenticates to every camera it pulls from, over RTSP and ONVIF, and it does that unattended, so the credentials sit on the device in a form the software can use without a human present. How recoverable they are depends on the implementation. Root also allows deletion or alteration of the archive any subsequent investigation would depend on, and a persistent listener on a segment that gets less scrutiny than the corporate LAN.

Whether an implant survives a factory reset depends on the boot design, which is model-specific. Establish it for your models before an incident rather than during one.

Settle one divergence before you rank this. NVD scores it 7.8 HIGH. Synology-SA-21:02 rates the same CVE Low, with its own CVSS3 base score of 6.7, and rates every affected product Low (advisory checked 2026-09-05). Both positions are arguable: the vendor reasoning about a hardened appliance with no interactive users, NVD about a general-purpose Linux host. Plan against 7.8 unless you can demonstrate the appliance offers no path to unprivileged local execution.

Exploitation evidence#

Facts:

• CISA added CVE-2021-3156 to the Known Exploited Vulnerabilities catalogue on 2022-04-06, with a remediation due date of 2022-04-27 and the action "Apply updates per vendor instructions." Ransomware use: Unknown. Catalogue release used here: 2026.09.04.
• The KEV entry's vendorProject and product fields both read "Sudo".

The reference set needs pruning before it is counted. NVD carries 35 distinct references for this CVE, 12 of them tagged exploit. Four are Packet Storm postings for this bug — files/161160, 161230, 161270 and 161293 — all from 2021, alongside the oss-security advisory itself, which appears twice, once as http and once as https, so a naive count double-counts it. Three of those twelve exploit entries, plus a fourth tagged other, are 2024 postings about CVE-2023-6246, the heap overflow in glibc's __vsyslog_internal(): Packet Storm files/176932, seclists 2024/Feb/3, and oss-security 2024/01/30/6 and /8. That is a different vulnerability in a different component, filed under this CVE's references. Anyone sizing the threat by counting exploit tags will overcount by four. The Qualys write-up, the primary source for the whole bug, is not in NVD's reference set at all; it is cited here directly.

What survives that pruning: public working exploit code for sudo, dated 2021, from four independent postings.

EPSS is a modelled probability, not a measurement. The score for this CVE is 0.99969, at the 99.977th percentile, calculated 2026-09-04. Read literally, it predicts that exploitation activity against something running vulnerable sudo will be observed in the next 30 days. It is not a count of attacks, not a measure of "wide use", and not a statement about your VS960HD. The percentile places the CVE against every other scored CVE, at the top of the scale.

Not established: these sources contain no report of CVE-2021-3156 being used against a video appliance. No incident, no named campaign, no victim count. Any briefing that states otherwise should name the artefact it rests on.

Affected products#

Synology-SA-21:02 covers more than the recorder. As checked on 5 September 2026 it lists DSM 6.2 ("Upgrade to 6.2.4-25554 or above."), DSM UC ("Upgrade to 3.1-23033 or above."), SkyNAS as Pending, VS960HD as Ongoing, and SRM 1.2 as not affected. Of the four affected products, the two DSM lines are the only ones given a named fixed build. SkyNAS and the VS960HD have neither, five and a half years on.

Two unknowns remain in the record. NVD's version ranges are not annotated with which build line each belongs to, so < 2.2.3-1505 and < 2.3.6-1720 cannot be resolved to a single upgrade target from the record alone. And a CPE entry asserts that a product is affected; it says nothing about whether the vulnerable code path is reachable on that product.

Fragility of the mapping#

Scanner matching runs on CPE. The tool fingerprints the recorder, decides it is a Synology video appliance, and asks the database which CVEs name that identifier. Here the database answers, because the CPE configuration for CVE-2021-3156 includes VS960HD. No mechanism guarantees the next component flaw gets one. NVD's CPE assignment is part analyst work and part automation, and the record does not say which produced this entry.

Three consequences follow, and they compound.

KEV-driven work queues key on vendorProject and product. Both fields read "Sudo". A team that filters the catalogue by its camera vendors will never surface this entry, because the catalogue is genuinely describing sudo.

Vendor response is discretionary and uneven. Synology published within a month of disclosure, rated it Low, and has left the VS960HD row at "Ongoing"; the advisory's own last-updated stamp is 1 September 2021.

Where a scanner matches only on CPE, a clean appliance result reports the absence of a mapping in the database rather than the absence of the flaw on the device.

Checks to run#

Qualys publishes a test under the heading "How can I test if I have vulnerable version?" — run sudoedit -s /. An error beginning sudoedit: indicates a vulnerable build; one beginning usage: indicates a patched one. The test needs a shell on the device, which on a locked-down appliance you may not have and should not enable for this. Appliance shells are also frequently stripped, so treat an unexpected response as inconclusive. Record an absent sudoedit as a result rather than a failed test. Cross-check sudo --version against 1.9.5p2 and against the Qualys ranges above.

The longer-run check is procedural. Ask each video vendor, in writing, for an SBOM covering the firmware build you actually run. Where you do not get one, record "component inventory: unknown" against that model along with the date you asked, so a missing answer is not later read as a clean one. Then, when the next component CVE lands on something ubiquitous — a glibc, an OpenSSL — you already have the list of models to ask about and a record of which vendors answered last time.

Sources

1. CVE-2021-3156 detail. NVD, 2026-06-17
2. Known Exploited Vulnerabilities Catalog, release 2026.09.04. CISA, 2026-09-04
3. EPSS model output for CVE-2021-3156, scored 2026-09-04. FIRST, 2026-09-04
4. Baron Samedit: heap-based buffer overflow in sudo (CVE-2021-3156). Qualys, via openwall oss-security, 2021-01-26
5. Baron Samedit: heap-based buffer overflow in sudo. Qualys, 2021-01-26; accessed 2026-09-05
6. Synology-SA-21:02 Sudo. Synology, published 2021-02-22, last updated 2021-09-01; accessed 2026-09-05
7. sudo stable release notes, 1.9.5p2. Sudo Project, 2021
8. CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog(). Qualys, via openwall oss-security, 2024-01-30; accessed 2026-09-05

Revision history