Synology Urges NAS Owners to Update DSM After Ransomware Attacks

If you own a Synology network storage device, check now that Synology DSM, its operating system, is up to date. Synology said on 29 October that attackers are exploiting a vulnerability it patched in December 2024 to target devices running outdated versions of DSM, in attacks that “aim to encrypt data and extort ransom”.

The Taipei-based company “strongly urges all users running vulnerable versions to update DSM immediately”. It also recommends turning on automatic updates so the system stays current. Its warning points to a security advisory, Synology-SA-24:20, which covers three flaws, one of them rated critical.

What Synology DSM owners should do now

• Update DSM. Synology’s advisory lists the minimum safe versions for each line: 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8. Anything older on those lines is vulnerable. The advisory lists no mitigation, so updating is the fix.
• Turn on automatic updates. Synology recommends this so DSM stays current without anyone having to remember. The update settings sit under Update & Restore in Control Panel.
• Limit internet exposure. Synology’s own security guidance “strongly” recommends opening router ports only for the services you need, and using a VPN for remote management “instead of exposing DSM management ports directly to the internet”.
• Use the built-in firewall. Synology suggests allow rules for trusted addresses only, with everything else denied.
• Lock down accounts. Its guidance advises deactivating the default admin account (after checking another administrator can sign in), turning on multi-factor authentication and enabling auto block for repeated failed logins.
• Make sure you can recover. Against ransomware, Synology recommends regular snapshots with a protection period, which makes them immutable on supported models, and off-site backups that follow the 3-2-1 rule.

What the advisory says

Synology first published Synology-SA-24:20, titled “DSM (PWN2OWN 2024)”, on 5 November 2024. It credits researchers from the DEVCORE Research Team and Ryan Emmons of Team Smoking Barrels. Fixes for the different DSM lines followed through November, and the DSM 6.2 update arrived on 5 December 2024, according to the advisory’s revision history.

The advisory covers three flaws in Synology DSM. CVE-2024-10441 is rated critical, with a CVSS score of 9.8 out of 10; Synology says it “allows remote attackers to execute arbitrary code”. The other two are rated moderate. CVE-2024-50629 (5.3) lets remote attackers “read limited files”, and CVE-2024-10445 (4.3) lets them “write limited files”. The US National Vulnerability Database lists all three. It scores CVE-2024-10445 slightly higher, at 5.3. The same CVE records also list Synology’s BeeStation OS before version 1.1-65374 as affected.

Synology’s release does not say which of the three flaws attackers are using. It does not say how many devices have been hit, who is behind the attacks or which ransomware is involved. None of the three flaws appeared in the US Cybersecurity and Infrastructure Security Agency’s catalogue of known exploited vulnerabilities when TSN checked on 30 October.

Why an old Synology DSM fix still matters

The fix has been available for almost two years, and the attacks are still finding targets. That is the uncomfortable point in Synology’s warning. A network storage box is often bought, set up once and then left alone in a cupboard or a small office for years. If automatic updates are off, Synology DSM can stay on a version from 2024 while the device keeps working normally. Nothing on screen tells its owner that it is exposed.

These devices also hold exactly what ransomware crews want to lock: family photos, business files and, often, backups of other computers. When the backup copy lives on the same box that gets encrypted, there may be nothing left to restore from. That is why Synology’s advice goes beyond patching to immutable snapshots and off-site copies.

Remote access makes things worse. Many owners open DSM to the internet so they can reach files from anywhere, which also lets attackers find them. Synology’s guidance to use a VPN rather than exposing management ports reduces that risk even before a new flaw appears.

The pattern is a familiar one this week. TSN has reported Drupal warning that a highly critical flaw is being exploited, WordPress fixing an update flaw attackers are already probing and Cisco patching a VPN zero-day already in use. Edge devices such as VPN gateways have been a steady target, as in the Ivanti Connect Secure attacks. Synology’s case differs because the fix is old. The risk now sits with devices nobody has updated, not with a gap the vendor has yet to close.

Synology DSM owners who are unsure of their version can find it in Control Panel under Info Center. If it is older than the versions above, update first and then review exposure and backups.

Sources

Primary:

• Synology, “Synology urges users to update DSM following ransomware attacks on outdated DSM versions”, press release, 29 October 2026. https://www.synology.com/en-global/company/news/article/C3RB3R
• Synology, Security Advisory Synology-SA-24:20, “DSM (PWN2OWN 2024)”, published 5 November 2024, last updated 28 March 2025. https://www.synology.com/en-global/security/advisory/Synology_SA_24_20
• National Vulnerability Database (NIST), CVE-2024-10441. https://nvd.nist.gov/vuln/detail/CVE-2024-10441 ; CVE-2024-50629 https://nvd.nist.gov/vuln/detail/CVE-2024-50629 ; CVE-2024-10445 https://nvd.nist.gov/vuln/detail/CVE-2024-10445
• Synology Knowledge Center, “What can I do to enhance the security of my Synology NAS?”, updated 30 October 2026. https://kb.synology.com/en-global/DSM/tutorial/How_to_add_extra_security_to_your_Synology_NAS
• CISA, Known Exploited Vulnerabilities Catalog (JSON feed), checked 30 October 2026. https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

Press:

• None.

Related stories

• Drupal Warns Highly Critical Commerce Core Flaw Is Being Exploited
• Cisco Patches ASA and FTD VPN Zero-Day That Attackers Are Using
• WordPress 7.1.4 Fixes an Update Flaw Attackers Are Already Probing