Synology warns ransomware operators are targeting outdated NAS devices

Synology has issued a warning that ransomware operators are targeting NAS devices running outdated DSM software, exploiting a 2024 vulnerability that the vendor had already addressed by December 2024. The company says attackers are focusing on systems that have not applied available security fixes, placing data on these NAS boxes at risk of encryption and extortion.

While Synology has not disclosed which specific flaw is being used in the current campaign, it points customers to Synology SA-24:20, a security advisory published on 5 November 2024, which documents three DSM flaws and notes that fixes were rolled out across different software branches, including the DSM 6.2 update released on 5 December 2024. The advisory lists three vulnerabilities with varying impacts, rather than confirming a single exploit in the ongoing ransomware activity.

The vulnerabilities cited include CVE-2024-10441, described as the most serious with a CVSS of 9.8, relating to the system plugin daemon and allowing an unauthenticated remote attacker to execute arbitrary code; CVE-2024-50629 (CVSS 5.3) affecting the DSM webapi component, potentially enabling remote reading of limited files; and CVE-2024-10445 (CVSS 4.3) concerning improper certificate validation in the update functionality, with potential for limited file writes by an attacker on an adjacent network position.

Synology stresses that none of these flaws is confirmed as the exact entry point in the current campaign, and urges users to update to the latest fixed builds listed in the advisory. The impact can extend beyond the NAS itself, potentially threatening backups and accompanying documents essential to restoring other systems. The company also recommends enabling automatic updates to sustain future fixes.

The report attributes these details to Synology and Security Advisory SA-24:20, with the promotion of DSM version milestones and the risk posture clearly framed.