Taiwanese network attached storage (NAS) manufacturer Synology has fixed a critical security flaw that affects DiskStation and BeePhotos and could lead to remote code execution.
Tracked as CVE-2024-10443 and duplicated RISK: STATION by Midnight Blue, the zero-day flaw was demonstrated at the Pwn2Own Ireland 2024 hacking competition by security researcher Rick de Jager.
RISK:STATION is “an unauthenticated zero-click vulnerability that allows attackers to gain root-level code execution on popular Synology DiskStation and BeeStation NAS devices, affecting millions of devices,” a Dutch company said.
The zero-click nature of the vulnerability means that it does not require any user interaction to trigger the exploit, allowing attackers to gain access to devices to steal sensitive data and install additional malware.
The flaw affects the following versions −
No further technical details about the vulnerability have been released yet to give customers enough time to apply the fixes. Midnight Blue said there are between one and two million Synology devices that are currently both exposed and exposed to the Internet.
QNAP fixes 3 critical bugs
The disclosure comes after QNAP fixed three critical flaws affecting QuRouter, SMB Service and HBS 3 Hybrid Backup Sync, all of which were exploited during Pwn2Own –
- CVE-2024-50389 – Fixed in QuRouter 2.4.5.032 and later
- CVE-2024-50387 – Fixed in SMB Service 4.15.002 and SMB Service h4.15.002 and later
- CVE-2024-50388 – Fixed in HBS 3 Hybrid Backup Sync 25.1.1.673 and later
While there is no evidence that any of the aforementioned vulnerabilities have been exploited in the wild, users are encouraged to apply the patches as soon as possible, given that NAS devices have been valuable targets for ransomware attacks in the past.
