We have reviewed our software in response to the recently announced critical vulnerabilities affecting PHP.
Synergy suite including Synergy hardware
Our review confirms that Synergy, Synergy Web and the Synergy mobile app do not use PHP and are not affected by these PHP vulnerabilities. Synergy hardware such as PSNs are unaffected.
Synergy optionally supports online mapping services including Open Street Map, Google Maps and selected Esri mapping services. There are currently no related vulnerabilities listed with these services but Synectics continue to monitor this situation.
Synergy also supports custom panels, which allow customers to display externally hosted websites within the application. These websites are operated independently and may use PHP. Synectics does not manage or monitor the server-side technology or security of websites selected for custom panels. If you use custom panels to display web pages, please contact the relevant vendor to confirm whether their website uses PHP and whether it has been updated. Displaying an external website in a Synergy panel does not mean that the website’s PHP is running within Synergy.
Cloud Evidence Locker
Our review confirms that Cloud Evidence Locker does not use PHP and is not affected by these PHP vulnerabilities.
Transport
For the Synectics T2000 (all variants), PHP is exposed only through the locally accessible Web UI. The vulnerability could potentially be misused through this interface, but the Web UI is accessible only from the local network; it is not accessible through a remote or GSM connection. We will issue a firmware update imminently to upgrade the PHP version.
Cameras and encoders
We continue to evaluate our broader product set including our COEX cameras, IP cameras and encoding technology and will update this article with further information.
Please contact your Synectics representative if you have further questions.