CVE-2024-10441
CVE-2024-10445 · CVE-2024-50629Remote code execution in Synology DiskStation Manager and BeeStation OS
An output-encoding flaw in Synology's system plugin daemon lets a remote attacker run arbitrary code (commands of the attacker's choosing) on affected DiskStation Manager and BeeStation OS devices. Outdated NAS units are being hit by C3RB3R ransomware, and Synology has warned customers to update immediately. Patched versions are available, and the flaw is not on CISA's known-exploited list.
Synology DiskStation Manager (DSM) · Updated 2 Nov · From 2 of our stories and the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeveritycriticalCVSS 9.8 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| DiskStation Manager (DSM) 7.2 | 7.2.2-72806-1 |
| DiskStation Manager (DSM) 7.2-64570-4 | 7.2-64570-4 |
| DiskStation Manager (DSM) 7.1 | 7.1.1-42962-7 |
| DiskStation Manager (DSM) 6.2 | 6.2.4-25556-8 |
What to do
- Update DiskStation Manager to the fixed 7.2.2-72806-1 or 7.1.1-42962-7 build, and BeeStation OS to 1.1-65374, as Synology urges.
- Keep the NAS management interface off the public internet; the reported victim's device was internet-accessible and roughly a year and a half out of date.
What happened
- 29 OctA Reddit user reports ransomware on an exposed Synology DS918+; log analysis suggests it likely involved CVE-2024-10441.
- 2 NovSynology warns customers of C3RB3R ransomware attacks and urges immediate DSM updates; BleepingComputer and Tom's Hardware cover the warning.
The 3 records
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2024-10441 | Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Mana… | critical 9.8 | No | 1.3% |
| CVE-2024-10445 | Improper certificate validation vulnerability in the update functionality in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM… | medium 4.3 | No | 0.4% |
| CVE-2024-50629 | Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager … | medium 5.3 | No | 32% |
Our reporting
2 NovSynology warns customers of C3RB3R ransomware attacks, urges immediate DSM updates29 OctRansomware hits exposed Synology NAS, likely exploiting 18-month-old flawReported elsewhere
BleepingComputer · 2 NovSynology warns of C3RB3R ransomware attacks targeting NAS devices ↗Latest from Tom's Hardware · 29 OctTech whiz's internet-accessible Synology NAS gets bit by ransomware attack from 18-month-old remote code execution flaw ↗The records
synology.com: advisory ↗synology.com: advisory ↗synology.com: advisory ↗synology.com: advisory ↗CVE-2024-10441 on NVD ↗CVE-2024-10445 on NVD ↗CVE-2024-50629 on NVD ↗Is anything you run affected?Connect Zotpaper to Claude, ChatGPT or Cursor and ask. It checks your project's packages against this vulnerability and every other one in the advisory databases, and says what to update. Your first 20 lookups are free.
Try it free