Overview
Synology is urging customers to update DiskStation Manager (DSM) after observing ransomware attacks against Network Attached Storage devices running outdated software. According to The Hacker News, the attackers are exploiting a vulnerability that the Taiwanese vendor patched in 2024.
Customers have reported infections by a ransomware family known as C3RB3R, which encrypts files and appends the .L0CK3D extension.
Which flaw?
Synology did not name the exact vulnerability being exploited. It pointed to its November 2024 advisory (Synology_SA_24_20), which covered three CVEs:
| CVE | CVSS | Description |
|---|---|---|
| CVE-2024-10441 | 9.8 | Output encoding flaw in the system plugin daemon, potentially leading to remote code execution |
| CVE-2024-50629 | 5.3 | Output encoding flaw in the webapi component, allowing limited remote file reads |
| CVE-2024-10445 | 4.3 | Certificate validation flaw in the DSM update function, allowing limited remote file writes |
Reporting notes a discrepancy between the advisory date and the "December 2024" patch timing cited for the exploited bug, so treat the precise mapping as unconfirmed. Either way, every listed fix is long available.
Fixed versions
- DSM 7.2.2: 7.2.2-72806-1 or later
- DSM 7.2.1: 7.2.1-69057-6 or later
- DSM 7.2: 7.2-64570-4 or later
- DSM 7.1: 7.1.1-42962-7 or later
- DSM 6.2: 6.2.4-25556-8 or later
Recommended actions
- Update DSM immediately and enable automatic updates.
- Do not expose DSM management ports (5000/5001) directly to the internet; use a VPN or reverse proxy with authentication.
- Keep offline or immutable backups, since NAS-resident snapshots may be reachable by an attacker with admin rights.
- If you see
.L0CK3Dfiles, disconnect the device from the network and preserve it for investigation before restoring.
Context
NAS devices have long been a favorite ransomware target: QNAPCrypt/eCh0raix hit QNAP units in 2019, StealthWorker brute-forced Synology devices in 2021, and later eCh0raix variants abused CVE-2021-28799 or weak admin credentials. The pattern is consistent: unpatched, internet-reachable storage appliances.