No menu items!
No menu items!
More

    Synology Urges Patch for Critical Zero-Click RCE Flaw Affecting Millions of NAS Devices

    Nov 05, 2024Ravie LakshmananVulnerability / Data Security

    NAS Devices

    Taiwanese network-attached storage (NAS) appliance maker Synology has addressed a critical security flaw impacting DiskStation and BeePhotos that could lead to remote code execution.

    Tracked as CVE-2024-10443 and dubbed RISK:STATION by Midnight Blue, the zero-day flaw was demonstrated at the Pwn2Own Ireland 2024 hacking contest by security researcher Rick de Jager.

    RISK:STATION is an “unauthenticated zero-click vulnerability allowing attackers to obtain root-level code execution on the popular Synology DiskStation and BeeStation NAS devices, affecting millions of devices,” the Dutch company said.

    The zero-click nature of the vulnerability means it does not require any user interaction to trigger the exploitation, thereby allowing attackers to gain access to the devices to steal sensitive data and plant additional malware.

    Cybersecurity

    The flaw impacts the following versions –

    Additional technical details about the vulnerability have been currently withheld so as to give customers sufficient time to apply the patches. Midnight Blue said there are between one and two million Synology devices that are currently simultaneously affected and exposed to the internet.

    QNAP Patches 3 Critical Bugs

    The disclosure comes as QNAP resolved three critical flaws affecting QuRouter, SMB Service, and HBS 3 Hybrid Backup Sync, all of which were exploited during Pwn2Own –

    • CVE-2024-50389 – Fixed in QuRouter 2.4.5.032 and later
    • CVE-2024-50387 – Fixed in SMB Service 4.15.002 and SMB Service h4.15.002, and later
    • CVE-2024-50388 – Fixed in HBS 3 Hybrid Backup Sync 25.1.1.673 and later

    While there is no evidence that any of the aforementioned vulnerabilities have been exploited in the wild, users are advised to apply the patches as soon as possible given that NAS devices have been high-value targets for ransomware attacks in the past.

    Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

    https://thehackernews.com/2024/11/synology-urges-patch-for-critical-zero.html

    Latest articles

    spot_imgspot_img

    Related articles