# CVE-2023-37220: Synel Terminals - CWE-494: Download of Code Without Integrity Check

> Attackers can inject malicious code into Synel Terminals by exploiting the lack of integrity checks during software downloads.

- **Severity:** High 7.2 (`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** An administrator
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** No
- **Published:** 3 Sep 2023
- **Updated:** 1 Oct 2024
- **Also known as:** GHSA-m44r-gw9x-mgm2

## What is CVE-2023-37220?

CVE-2023-37220 is a high-severity vulnerability in Synel  Terminals, published on 3 Sep 2023. An attacker needs administrator access to exploit it, with no action from the victim.

### Official description

Synel Terminals - CWE-494: Download of Code Without Integrity Check

Weakness: CWE-494 (Download of Code Without Integrity Check)

## Which versions are affected by CVE-2023-37220?

It affects 21 products.


Products: Synel Bioentry-W2 Firmware, Synel Bioentry P2 Firmware, Synel Biolite-N2 Firmware, Synel Sy-711 Firmware, Synel Sy-715 Firmware, Synel Sy-745 Firmware, Synel Sy-7500 Firmware, Synel Sy-751 Firmware, Synel Sy-755 Firmware, Synel Sy-765 Firmware, Synel Sy-777 Firmware, Synel Sy-780 Firmware, Synel Sy-785 Firmware, Synel Sy-910 Firmware, Synel Sy110 Face Firmware, Synel Synergy\/a Firmware, Synel Synergy\/X Firmware, Synel Synergy 10 Firmware, Synel Synergy 5 Firmware, Synel Synergy Firmware and 1 more.

## How do I fix CVE-2023-37220?

No fix has been published for CVE-2023-37220 yet. Limit exposure of the affected software until one is available.

## Is CVE-2023-37220 being exploited?

There is no known exploitation of CVE-2023-37220 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2023-37220 and fix it if it is affected.

What it is: CVE-2023-37220 is a high-severity vulnerability in Synel  Terminals, published on 3 Sep 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2023-37220 in the wild and no public exploit code.

Affected product: Synel  Terminals. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2023-37220/ (Markdown: https://insights.sbomify.com/CVE-2023-37220/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2023-37220
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-37220
- OSV: https://osv.dev/vulnerability/CVE-2023-37220

---
From sbomify Insights: https://insights.sbomify.com/CVE-2023-37220/
Summaries are generated and may contain mistakes; the official description above is the record.