CVE-2024-10445
Faulty certificate checks in DSM's update function let an attacker intercepting traffic on an adjacent network write a limited set of files.
Update your Synology NAS to the latest DSM supported by its model and enable automatic updates; ask whoever manages it to check the branch-specific fixes below. Remove public internet access to its management interface. Keep an offline backup disconnected from the NAS.
- Affects
- Synology NAS devices running DiskStation Manager (DSM)
- Severity
- Medium · CVSS 4.3
- Fixed in
- SA-24:20: DSM 7.2.2-72806-1 or above
SA-24:20: DSM 7.2.1-69057-6 or above
SA-24:20: DSM 7.2-64570-4 or above
SA-24:20: DSM 7.1.1-42962-7 or above
SA-24:20: DSM 6.2.4-25556-8 or above
SA-26:13: DSM 7.4-90075 or above
SA-26:13: DSM 7.3.2-86009-4 or above
SA-26:13: DSM 7.2.2-72806-9 or above
SA-26:13: DSM 7.2.1-69057-12 or above - Being used in attacks
- Not known to be
- Made public
- 29 Oct 2026
Part of: Synology NAS devices hit by C3RB3R ransomware through unpatched DSM flaws
Synology NAS owners at home and work face ransomware attacks against outdated DiskStation Manager (DSM), the software running their storage devices. Synology says attackers are exploiting a flaw patched in December 2024, but has not identified its CVE. Its linked advisory covers three flaws involving running code, reading files and writing files. Separately, Qihoo 360 attributes C3RB3R attacks it investigated to two different DSM flaws patched in September 2026. These accounts identify different vulnerabilities; Synology has not reconciled them publicly. Fixes are available for the affected DSM branches listed in both advisories. Owners should install the latest DSM supported by their model rather than rely only on the older minimum fixes.
Fixed in the same update
- CVE-2024-10441Remote code execution in Synology DSM's plugin daemon
- CVE-2024-50629File disclosure in Synology DSM's web API
- CVE-2026-13639Insufficient randomness in Synology DSM login logic
- CVE-2026-13684Output escaping flaw in Synology DSM's SCGI component
Sources
- Synology-SA-24:20 DSM (PWN2OWN 2024)Synology · 28 Mar 2025
- Synology-SA-26:13 DSMSynology · 18 Sept 2026
- Synology urges users to update DSM following ransomware attacks on outdated DSM versionsSynology · 29 Oct 2026
- Cerber ransomware attacks on Synology NAS: incident warningQihoo 360 · 29 Oct 2026
- Synology warns of C3RB3R ransomware attacks targeting NAS devicesBleepingComputer · 3 Nov 2026
- Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM FlawThe Hacker News · 3 Nov 2026