Attackers are actively targeting outdated Synology DiskStation Manager (DSM) devices to encrypt data and demand ransoms, exploiting security flaws patched in late 2024, ITdaily reported. Taiwanese hardware vendor Synology urged administrators to apply available software updates immediately and enable automatic updates to protect network-attached storage units.
Critical Flaw CVE-2024-10441 Drives Active Exploitation
The ongoing extortion campaign uses security advisory Synology-SA-24:20, which details multiple vulnerabilities discovered during the Pwn2Own 2024 hacking competition. Researchers Pumpkin Chang and Orange Tsai of the DEVCORE Research Team uncovered the most severe issue, cataloged as CVE-2024-10441. The vulnerability carries a maximum CVSS severity score of 9.8.
The flaw exists within the system plugin daemon, allowing remote attackers to execute arbitrary code without requiring prior authentication. Alongside this critical remote code execution vector, the same advisory includes two moderate-risk vulnerabilities. CVE-2024-50629 permits unauthorized reading of limited files, while CVE-2024-10445 enables limited file writes through the system update mechanism.
Required DSM Version Updates to Block Ransoms
Synology confirmed that no temporary workarounds exist to mitigate the vulnerabilities, making software updates the sole defense. Administrators must upgrade devices to specific patched builds depending on their active DSM branch. BeeStation OS users operating versions older than 1.1-65374 face similar exposure and require immediate patching.
Pro tip: Upgrade your NAS to the latest available build within your current major version branch to automatically resolve the 2024 vulnerabilities. Synology has not disclosed the total number of hardware units affected by the ongoing extortion attempts.
| DSM Version | Secure Build Requirement |
|---|---|
| DSM 7.2.2 | 7.2.2-72806-1 or higher |
| DSM 7.2.1 | 7.2.1-69057-6 or higher |
| DSM 7.2 | 7.2-64570-4 or higher |
| DSM 7.1 | 7.1.1-42962-7 or higher |
| DSM 6.2 | 6.2.4-25556-8 or higher |
Frequently Asked Questions About Synology DSM Ransoms
Which specific vulnerability allows unauthenticated remote code execution?
CVE-2024-10441 allows attackers to run arbitrary code remotely without logging in. The flaw received a CVSS score of 9.8.
Who discovered the critical remote code execution flaw?
Researchers Pumpkin Chang and Orange Tsai from the DEVCORE Research Team found the bug during the Pwn2Own 2024 hacking competition.
Are there any temporary configuration workarounds available?
No temporary workarounds exist. Applying an official software update is the only method to close the security gaps.
Related reading