Taiwanese network-attached storage (NAS) appliance maker Synology has addressed a critical security flaw impacting DiskStation and BeePhotos that could lead to remote code execution.
Tracked as CVE-2024-10443 and dubbed RISK:STATION by Midnight Blue, the zero-day flaw was demonstrated at the Pwn2Own Ireland 2024 hacking contest by security researcher Rick de Jager.
RISK:STATION is an “unauthenticated zero-click vulnerability allowing attackers to obtain root-level code execution on the popular Synology DiskStation and BeeStation NAS devices, affecting millions of devices,” the Dutch company said.
The zero-click nature of the vulnerability means it does not require any user interaction to trigger the exploitation, thereby allowing attackers to gain access to the devices to steal sensitive data and plant additional malware.
The flaw impacts the following versions –
Additional technical details about the vulnerability have been currently withheld so as to give customers sufficient time to apply the patches. Midnight Blue said there are between one and two million Synology devices that are currently simultaneously affected and exposed to the internet.
QNAP Patches 3 Critical Bugs
The disclosure comes as QNAP resolved three critical flaws affecting QuRouter, SMB Service, and HBS 3 Hybrid Backup Sync, all of which were exploited during Pwn2Own –
- CVE-2024-50389 – Fixed in QuRouter 2.4.5.032 and later
- CVE-2024-50387 – Fixed in SMB Service 4.15.002 and SMB Service h4.15.002, and later
- CVE-2024-50388 – Fixed in HBS 3 Hybrid Backup Sync 25.1.1.673 and later
While there is no evidence that any of the aforementioned vulnerabilities have been exploited in the wild, users are advised to apply the patches as soon as possible given that NAS devices have been high-value targets for ransomware attacks in the past.