Urgent warning to protect Network Attached Storage
Synology, a company specializing in the manufacture of Network Attached Storage (NAS) devices, has issued a security warning urging its customers to urgently update the DiskStation Manager (DSM) operating system, following a notable rise in ransomware attacks known as C3RB3R (or Cerber). The company explained that attackers are exploiting security vulnerabilities that were previously addressed in late 2024 to encrypt data on unpatched devices and extort their owners.
The company emphasized the necessity of enabling the automatic updates option to prevent the exploitation of these vulnerabilities, in addition to restricting or blocking access to the device management interface from the direct internet as an immediate precautionary step to prevent system breaches.
Details of exploited vulnerabilities and required updates
The current attacks are linked to a security flaw for which patches were previously released, as these vulnerabilities allow attackers to execute malicious software remotely and read or write files on target devices. The most significant vulnerabilities referred to include:
- CVE-2024-10441: A high-severity vulnerability that allows for the remote execution of arbitrary commands and software.
- CVE-2024-50629: A vulnerability that allows files to be read from the device without authorization.
- CVE-2024-10445: A vulnerability that enables an attacker to write and modify files on unpatched devices.
Synology called on users to upgrade their DSM versions according to the secure versions it has made available, including version 7.2.2-72806-1 or later for DSM 7.2.2 users, and version 7.2.1-69057-6 for 7.2.1 users, in addition to providing updates for the 7.2, 7.1, and 6.2 version series.
Context of the attacks and practical implications
Reports from affected users began to appear widely after their files were encrypted and the .L0CK3D extension was added to them, with a text file left containing payment instructions to purchase a decryption tool via the dark web for thousands of dollars. The roots of the C3RB3R software trace back to the famous Cerber ransomware that appeared in 2016 and was active in targeting servers and enterprise systems.
Why do these attacks hold special significance?
Direct warnings of this kind from Synology are rare, as the last similar warning dates back to 2019. The practical danger lies in the existence of more than 380,000 Synology NAS devices connected to the internet and exposed to the public according to data from the security tracking platform Shadowserver, making these devices an easy target for attackers if security updates are not installed and management interfaces are not isolated from the public network immediately.