Synology has warned customers to update their DiskStation Manager (DSM) software now because attackers are encrypting data on NAS devices running outdated versions and demanding a ransom. In its advisory the company said threat actors are exploiting “a vulnerability patched in December 2024,” and recommended turning on automatic updates. Synology has not said which specific flaw is being used. Its notice points to security advisory Synology-SA-24:20, which covers three bugs: remote code execution (CVE-2024-10441), file read (CVE-2024-50629) and file write (CVE-2024-10445).
BleepingComputer reports the warning follows a wave of complaints from Synology owners whose files were encrypted. Victims describe a ransom note named read-me3.txt, a .L0CK3D extension on encrypted files, and a dark-web page selling a “C3rb3r Decryptor” for thousands of dollars. The first reports appeared more than two weeks ago. BleepingComputer notes that Synology rarely issues warnings about attacks on its customers; its last was in August 2019 after eCh0raix ransomware infections. Shadowserver tracks more than 380,000 internet-exposed Synology NAS devices, though it does not say how many are patched.
How to check if you’re affected
Affected devices are Synology NAS units running a DSM version older than the fixed build in advisory Synology-SA-24:20: DSM 7.2.2 before 7.2.2-72806-1, DSM 7.2.1 before 7.2.1-69057-6, DSM 7.2 before 7.2-64570-4, DSM 7.1 before 7.1.1-42962-7, and DSM 6.2 before 6.2.4-25556-8. The advisory’s CVE text also lists Synology BeeStation OS (BSM) before 1.1-65374. It lists no mitigation other than updating.
Compare the DSM version installed on your NAS with the list above, update to the latest DSM available for your model, and enable automatic updates, as Synology recommends. BleepingComputer also says users should immediately block access to the management web interface from the internet. Victims report a read-me3.txt ransom note and files renamed with a .L0CK3D extension.