Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks.

The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM.

“These attacks aim to encrypt data and extort ransom,” it said in a statement released last week.

While Synology did not disclose the exact security flaw that’s being exploited in these attacks, the company linked to a November 2024 security advisory that listed three vulnerabilities –

• CVE-2024-10441 (CVSS score: 9.8) – An improper encoding or escaping of output vulnerability in the system plugin daemon of DSM that could lead to remote code execution via unspecified vectors.
• CVE-2024-50629 (CVSS score: 5.3) – An improper encoding or escaping of output vulnerability in the webapi component of DSM that could allow remote attackers to read limited files via unspecified vectors.
• CVE-2024-10445 (CVSS score: 4.3) – An improper certificate validation vulnerability in the update functionality in DSM that could allow remote attackers to write limited files via unspecified vectors.

The issues were addressed in the following versions –

• DSM 7.2.2 – Upgrade to 7.2.2-72806-1 or above
• DSM 7.2.1 – Upgrade to 7.2.1-69057-6 or above
• DSM 7.2 – Upgrade to 7.2-64570-4 or above
• DSM 7.1 – Upgrade to 7.1.1-42962-7 or above
• DSM 6.2 – Upgrade to 6.2.4-25556-8 or above

The development comes amid reports from customers that their Synology devices have been hit by C3RB3R ransomware, which has been observed locking users’ files with a “.L0CK3D” extension.

This is not the first time NAS devices have been the target of ransomware attacks. In 2019, NAS devices manufactured by Taiwan-based QNAP Systems were compromised by QNAPCrypt (aka eCh0raix) ransomware.

Then, in August 2021, Synology warned of brute-force attacks driven by a malware family called StealthWorker that led to ransomware infections.

“These attacks leverage a number of already infected devices to try and guess common administrative credentials, and if successful, will access the system to install its malicious payload, which may include ransomware,” it said at the time. “Devices infected may carry out additional attacks on other Linux-based devices, including Synology NAS.”

That same month, Palo Alto Networks Unit 42 also disclosed details of an eCh0raix variant targeting NAS devices from both QNAP and Synology by leveraging vulnerabilities like CVE-2021-28799 or brute-force their way in by making use of commonly used administrative credentials.

“Synology strongly urges all users running vulnerable versions to update DSM immediately to protect their systems,” the company said. “Synology also recommends enabling automatic updates to keep DSM up to date at all times.”