Synology Warns of Ransomware Attacks Targeting NAS Devices Running Outdated DSM

Synology is urging customers to update DiskStation Manager (DSM), the software used by its Network Attached Storage devices, after observing ransomware attacks against devices running outdated versions. The company said attackers are exploiting a vulnerability that was patched in December 2024, with the aim of encrypting data and demanding a ransom.

Synology has not identified the specific flaw being used. It referred users to a November 2024 security advisory covering three DSM vulnerabilities: CVE-2024-10441, which could allow remote code execution; CVE-2024-50629, which could let remote attackers read limited files; and CVE-2024-10445, which could allow remote attackers to write limited files. The advisory described the issues as involving output encoding or escaping, and certificate validation.

The fixes are available in DSM 7.2.2-72806-1 or later, 7.2.1-69057-6 or later, 7.2-64570-4 or later, 7.1.1-42962-7 or later, and 6.2.4-25556-8 or later, depending on the DSM branch.

The warning follows customer reports that Synology devices have been affected by C3RB3R ransomware, which locks files using the .L0CK3D extension. Synology recommends that users of vulnerable versions update DSM immediately and enable automatic updates to keep their systems current.

Sources: The Hacker News.