Synology is telling NAS owners to update DiskStation Manager after attackers began encrypting storage and demanding payment. The route in was a bug the vendor shipped a fix for in December 2024.
The company’s statement is short on specifics but points to a November 2024 advisory covering three defects, all in DSM. Customers have meanwhile reported devices locked with a .L0CK3D extension, the signature of C3RB3R ransomware.
The one that matters
CVE-2024-10441 carries a 9.8 and sits in the system plugin daemon. Improper encoding of output there allows remote attackers to execute code without credentials, which is exactly the shape of access a ransomware operator wants against a box that holds an organization’s backups and file shares.
The other two are milder. CVE-2024-50629 lets remote attackers read limited files through the webapi component, and CVE-2024-10445 is a certificate validation error that permits writing limited files through the update routine.
The version list to check tonight
Fixed builds are 7.2.2-72806-1 or newer on DSM 7.2.2, 7.2.1-69057-6 on 7.2.1, 7.2-64570-4 on 7.2, 7.1.1-42962-7 on 7.1 and 6.2.4-25556-8 on 6.2. Synology also wants automatic updates switched on.
NAS devices have drawn this treatment before, from QNAP’s QNAPCrypt wave in 2019 to the StealthWorker brute-force campaign against Synology hardware in 2021. Anything internet-facing and unpatched is a standing invitation.
