Synology tells NAS device users to patch immediately following zero-day reveal

Date:
Wed, 06 Nov 2024 16:08:00 +0000

Description:
A new vulnerability can be exploited without any user interaction, making it immensely dangerous.

FULL STORY ======================================================================Synology
has patched a zero-click flaw found in multiple NAS products This type of flaw can be exploited with no victim interaction, making it particularly dangerous Technical details were not disclosed to give customers time to
react

Top network-attached storage ( NAS ) makers Synology has patched a critical severity vulnerability which could have allowed threat actors to remotely execute malicious code on affected endpoints.

The vulnerability is tracked as CVE-2024-10443, and was found in DiskStation and BeePhotos. It was showcased during the recent Pwn2Own Ireland 2024 hackathon, where it was described as a zero-click flaw, and dubbed RISK:STATION.

A zero-click flaw is a security vulnerability that can be exploited without any interaction from the victim, like clicking a link or opening an attachment. Attackers can use zero-click flaws to remotely compromise devices simply by sending a malicious message or file, making them particularly dangerous and difficult to detect. No evidence of abuse

RISK:STATION was found affecting multiple versions of the above mentioned products:

BeePhotos for BeeStation OS 1.0
BeePhotos for BeeStation OS 1.1
Synology Photos 1.6 for DSM 7.2
Synology Photos 1.7 for DSM 7.2

As the vulnerability can lead to device takeover, loss of data, and worse,
the details have been withheld to give the majority of users time to react, and to prevent hackers from easily exploiting it.

Since the patch was already made available, users are advised to apply it immediately, or risk losing sensitive data to threat actors. So far, there
has been no evidence of in-the-wild abuse or Proof-of-Concepts (PoC), so its safe to assume the crooks havent picked the trail up just yet.

NAS instances are an attractive target for cybercriminals because they often hold vast amounts of sensitive data, including personal files, business documents, and backups.

Since NAS devices are frequently connected to networks and sometimes accessible over the internet, they can be vulnerable to ransomware, data theft, and other attacks if not properly secured, providing attackers with potential leverage for extortion or data exploitation.

Via The Hacker News You might also like Top NAS devices are being targeted
by this dangerous malware Here's a list of the best firewalls today These are the best endpoint protection tools right now



======================================================================
Link to news story: https://www.techradar.com/pro/security/synology-tells-nas-device-users-to-patc h-immediately-following-zero-day-reveal


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)