Synology is telling customers to update DiskStation Manager after seeing ransomware used against NAS devices running outdated DSM. Per The Hacker News, the company says the attackers are exploiting a vulnerability that was patched in 2024, and “these attacks aim to encrypt data and extort ransom.” Synology did not name the exact flaw. It linked its November 2024 advisory, Synology-SA-24:20, which covers three.
The one that matters is CVE-2024-10441. NVD describes an improper encoding or escaping of output in the system plugin daemon, remote code execution via unspecified vectors, CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N). Network reachable, no credentials, no clicking. The other two are small: CVE-2024-50629 (5.3) lets a remote attacker read limited files through the webapi component, and CVE-2024-10445 (4.3) is a certificate validation bug in the update path that allows limited file writes. The advisory credits the Pwn2Own 2024 reports, hence the title.
Fixed builds, straight from the advisory:
- DSM 7.2.2: 7.2.2-72806-1 or above
- DSM 7.2.1: 7.2.1-69057-6 or above
- DSM 7.2: 7.2-64570-4 or above
- DSM 7.1: 7.1.1-42962-7 or above
- DSM 6.2: 6.2.4-25556-8 or above
BeeStation OS has its own advisory (SA-24:23) and wants 1.1-65374 or above.
Customers report C3RB3R ransomware, which renames files with a .L0CK3D extension. Yes, the leet-speak is doing the heavy lifting for a gang that apparently couldn’t be bothered to write a new extortion note. The reporting doesn’t say how many devices are hit, and I won’t invent a number.
None of this is new. QNAP boxes got QNAPCrypt (eCh0raix) in 2019, and in August 2021 Synology itself warned about StealthWorker brute-forcing admin credentials. The pattern is the same every time: a cheap appliance, a vendor web UI, and an owner who set it up in 2021 and has not logged in since. A 9.8 that’s been public for two years is not a zero-day problem. It’s a “nobody owns this box” problem, which is a recurring theme in the reliability hub and exactly how the backup that restored perfectly went unwatched.
What to do, in order:
- Check your DSM build against the list above. If it’s older, update now.
- Turn on automatic updates, which Synology itself recommends.
- Take the management interface off the internet. If you can reach DSM from outside without a VPN, you are the exposure.
- Keep a copy of the data the NAS can’t write to. A snapshot on the same box is not a backup when the attacker owns the box. If you want a pattern for that, ZFS send/recv replication to a machine with its own credentials is the boring answer that works.
I’d say appliance vendors should ship updates that install themselves by default and nag louder. Then I remember how I feel about software that updates itself on production storage, and I sit back down. Both things are true. Pick the one that doesn’t end in a ransom note.