A Synology NAS device was compromised by a ransomware attack due to an unpatched remote code execution vulnerability. The unit had its web interface exposed directly to the internet and lacked critical security updates for approximately 18 months.
The attacker exploited the CVE-2024-10441 vulnerability. The owner of the device utilized a 3-2-1 backup strategy, which prevented data loss. The disks were subsequently moved to a Proxmox machine for forensic analysis of the logs and system files.
Users report that the Synology DSM interface may incorrectly indicate that a device is up to date, even when critical security patches require manual installation. The manufacturer's documentation notes that automatic updates are a feature for units from 2025 onwards.
The incident highlights issues with how security bulletins are communicated to customers. Synology currently lacks a direct email notification system for critical vulnerabilities, and package-specific updates, such as those for PHP2Shell, must be managed independently.
