Synology warns ransomware operators are targeting outdated NAS devices

Synology says its DiskStation Manager (DSM) software powering its NAS devices is being targeted again by ransomware operators, this time using exploits against versions it patched in December 2024. The firm disclosed that threat actors are taking advantage of outdated DSM releases to encrypt data and demand payments, a pattern it described in a statement issued last week.

While Synology did not identify the exact flaw being exploited in public detail, it pointed back to a November 2024 security advisory listing three vulnerabilities associated with the DSM platform.

The advisory cites CVE-2024-10441 (CVSS 9.8), an improper encoding or escaping of output in the system plugin daemon that could allow remote code execution; CVE-2024-50629 (CVSS 5.3), an output encoding issue in the webapi component permitting reading of limited files by remote attackers; and CVE-2024-10445 (CVSS 4.3), an improper certificate validation in the DSM update function enabling remote writers of limited files.

Patches were issued across DSM lineages: DSM 7.2.2 and above (7.2.2-72806-1+), DSM 7.2.1 (7.2.1-69057-6+), DSM 7.2 (7.2-64570-4+), DSM 7.1 (7.1.1-42962-7+), and DSM 6.2 (6.2.4-25556-8+). The company urges users of vulnerable versions to upgrade and to enable automatic updates to maintain protection, noting observed incidents linked to the C3RB3R ransomware variant that marks files with a ".L0CK3D" extension.