Synology NAS Boxes Hit by Ransomware as Users Drag Their Feet on Patching
Synology is pushing customers hard to update their DiskStation Manager software after ransomware operators were caught actively exploiting a vulnerability that was patched back in December 2024. If you're still running an outdated DSM version, that's on you at this point.
The Taiwanese NAS maker confirmed last week that attackers are targeting unpatched devices with the goal of encrypting data and demanding payment. Standard ransomware playbook, executed against people who didn't apply a fix that's been available for months.
Synology hasn't named the specific vulnerability being exploited, but pointed to a November 2024 advisory covering three flaws. The one that should make your eyes widen is CVE-2024-10441, scoring a 9.8 on the CVSS scale. It's an output encoding bug in DSM's system plugin daemon that enables remote code execution. The other two are considerably less alarming: CVE-2024-50629 (CVSS 5.3) allows limited file reads via the web API, and CVE-2024-10445 (CVSS 4.3) is a certificate validation failure in the update mechanism that could let attackers write limited files.
Fixes are available across all supported DSM branches. Users should be running DSM 7.2.2-72806-1 or later, 7.2.1-69057-6 or later, 7.2-64570-4 or later, 7.1.1-42962-7 or later, or 6.2.4-25556-8 or later, depending on which version they're on.
Customers on forums have been reporting infections from C3RB3R ransomware, which tags encrypted files with a .L0CK3D extension. Cheerful stuff.
This isn't exactly a new problem. NAS devices have been a favourite ransomware target for years. QNAP got hammered in 2019 by QNAPCrypt, also known as eCh0raix. Then in August 2021, Synology itself warned about StealthWorker, a botnet that brute-forced admin credentials on NAS boxes and dropped ransomware payloads. Palo Alto's Unit 42 flagged an eCh0raix variant the same month that went after both QNAP and Synology hardware using weak credentials or known CVEs.
The pattern is depressingly consistent: NAS devices sitting exposed, running old software, protected by default or weak passwords. Attackers don't need sophistication when the targets do the hard work for them.
Synology's advice is simple: update DSM now, and turn on automatic updates so this stops being a recurring drama.