Synology: ransomware attacks hit NAS still running DSM versions left unpatched since 2024

Synology says attackers are exploiting a DSM vulnerability fixed in late 2024 to encrypt the data of NAS devices running outdated versions and demand a ransom. The vendor points to its advisory Synology-SA-24:20 and asks every customer on a vulnerable version to update DSM immediately and to turn on automatic updates.

What happened

In a statement dated 29 October 2026, Synology said it had seen threat actors exploit a vulnerability patched in December 2024 against NAS devices still running old releases of DSM, its operating system. The aim of these attacks is to encrypt the data stored on the device and extort a ransom. The vendor refers to its advisory Synology-SA-24:20, first published in November 2024 after the Pwn2Own 2024 contest. The statement does not name the exact flaw used, the ransomware family or the number of victims.

Who is affected

Advisory SA-24:20 covers three vulnerabilities. The most serious, CVE-2024-10441, rated 9.8 on CVSS 3.1, lets a remote attacker run arbitrary code through the system plugin daemon without an account. CVE-2024-50629 (5.3) allows limited file reads through the web API, and CVE-2024-10445 (4.3) lets an attacker on the same network write limited files via the update mechanism. Synology has not said which of them is being exploited. Vulnerable releases are those older than DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8. In practice, any NAS that has not been updated for almost two years is a target, especially if its interface can be reached from the internet.

What to do now

1. Check the DSM version of every NAS, including forgotten ones in branch offices: Control Panel, then Info Center.
2. Update to the fixed release for your branch or, better, to the latest release available for your model.
3. Turn on automatic updates, as Synology recommends, so that security fixes are no longer left waiting.
4. Stop exposing the DSM interface (ports 5000 and 5001 by default) directly to the internet: use a VPN and restrict access with the firewall.
5. Look for signs of compromise: unknown administrator accounts, new scheduled tasks, renamed or encrypted files, unusual entries in the logs.
6. Keep a copy of your data outside the NAS, offline or immutable, and test a restore: a NAS is not a backup of itself.

Our take

A NAS is a server like any other, yet it often sits in a cupboard with no owner and no patching routine. A fix that has been available for two years only protects the devices where it was installed: these boxes belong in the same update and monitoring cycle as the rest of the fleet.

Sources

• Synology — Synology urges users to update DSM following ransomware attacks on outdated DSM versions
• Synology — Synology-SA-24:20 DSM (PWN2OWN 2024)
• The Hacker News — Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw

How we choose, verify and write our analyses →