Synology Urges Patch for Critical Zero-Click RCE Flaw Affecting Millions of NAS Devices

Taiwanese network-attached storage (NAS) appliance maker Synology has addressed a critical security flaw impacting DiskStation and BeePhotos that could lead to remote code execution.

Tracked as CVE-2024-10443 and dubbed RISK:STATION by Midnight Blue, the zero-day flaw was demonstrated at the Pwn2Own Ireland 2024 hacking contest by security researcher Rick de Jager.

RISK:STATION is an “unauthenticated zero-click vulnerability allowing attackers to obtain root-level code execution on the popular Synology DiskStation and BeeStation NAS devices, affecting millions of devices,” the Dutch company said.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

The zero-click nature of the vulnerability means it does not require any user interaction to trigger the exploitation, thereby allowing attackers to gain access to the devices to steal sensitive data and plant additional malware.

The flaw impacts the following versions –

• BeePhotos for BeeStation OS 1.0 (Upgrade to 1.0.2-10026 or above)
• BeePhotos for BeeStation OS 1.1 (Upgrade to 1.1.0-10053 or above)
• Synology Photos 1.6 for DSM 7.2 (Upgrade to 1.6.2-0720 or above)
• Synology Photos 1.7 for DSM 7.2 (Upgrade to 1.7.0-0795 or above)

Additional technical details about the vulnerability have been currently withheld so as to give customers sufficient time to apply the patches. Midnight Blue said there are between one and two million Synology devices that are currently simultaneously affected and exposed to the internet.

QNAP Patches 3 Critical Bugs

The disclosure comes as QNAP resolved three critical flaws affecting QuRouter, SMB Service, and HBS 3 Hybrid Backup Sync, all of which were exploited during Pwn2Own –

• CVE-2024-50389 – Fixed in QuRouter 2.4.5.032 and later
• CVE-2024-50387 – Fixed in SMB Service 4.15.002 and SMB Service h4.15.002, and later
• CVE-2024-50388 – Fixed in HBS 3 Hybrid Backup Sync 25.1.1.673 and later

While there is no evidence that any of the aforementioned vulnerabilities have been exploited in the wild, users are advised to apply the patches as soon as possible given that NAS devices have been high-value targets for ransomware attacks in the past.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.