Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw
Our summary
Synology has confirmed that ransomware operators are actively exploiting a DiskStation Manager (DSM) vulnerability that the company already fixed back in December 2024, hitting NAS devices still running outdated firmware. The vendor points to its November 2024 advisory covering three flaws: CVE-2024-10441 (CVSS 9.8), a system plugin daemon bug allowing remote code execution; CVE-2024-50629 (CVSS 5.3), enabling limited file reads via the webapi component; and CVE-2024-10445 (CVSS 4.3), a certificate-validation issue in the update mechanism letting attackers write limited files. Victims have reported their files being locked with a ".L0CK3D" extension by ransomware known as C3RB3R, echoing earlier NAS-targeting campaigns like QNAPCrypt and StealthWorker. Synology is urging all customers on vulnerable DSM builds to upgrade immediately to patched versions such as DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, or 6.2.4-25556-8, and to enable automatic updates going forward.
The Hacker News publishes this story on its own site; we link to it rather than reprint it.
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.