The bug that is hurting Synology owners this week is not new. Synology fixed it almost two years ago. The trouble is the large number of network-attached storage (NAS) boxes that never got the update.
In a statement dated Taipei, Oct. 29, 2026, Synology said it has identified threat actors exploiting a vulnerability patched in December 2024 to go after devices running outdated versions of DSM, the company's NAS operating system. The goal, according to Synology, is the usual ransomware model: encrypt the data on the box, then demand payment to give it back. The company told users to update right away and to turn on automatic updates.
Synology did not say which vulnerability is being exploited. It pointed readers to an older security advisory, Synology-SA-24:20, and left them to work out the rest.
What Synology pointed to
Synology-SA-24:20 is the advisory for DSM bugs disclosed through Pwn2Own 2024, the hacking contest where researchers are paid to break fully updated devices. It was first published Nov. 5, 2024, is rated Critical, and is marked Resolved. It covers three CVEs:
- CVE-2024-10441, CVSS 9.8: remote code execution in DSM's system plugin daemon. This is the serious one.
- CVE-2024-50629, CVSS 5.3: a limited file-read issue in the webapi component.
- CVE-2024-10445, CVSS 4.3: a limited file-write issue tied to how update certificates are validated (the advisory describes the attacker as adjacent, a man-in-the-middle position on the network).
The advisory's revision history shows DSM 6.2 was added on Dec. 5, 2024. That probably explains why Synology's new statement says the flaw was "patched in December 2024" even though the advisory first went up in November.
The National Vulnerability Database entry for CVE-2024-10441 was published March 19, 2025, using information supplied by Synology. It describes the flaw as improper encoding or escaping of output in the system plugin daemon. Put simply, the software fails to clean up data before handing it to another part of the system, and that lets remote attackers run arbitrary code "via unspecified vectors." NVD says the bug affects DSM before 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1. It also lists Synology's BeeStation OS (BSM) product before version 1.1-65374.
A CVSS score of 9.8 sits near the top of the scale. It usually means an attacker can exploit the bug over the network without logging in and without the victim doing anything. Synology hasn't confirmed that CVE-2024-10441 is the bug being used in these attacks. Still, it is the only remote code execution flaw in the advisory the company referenced, and it is the one defenders should assume matters most.
The ransomware customers say they're seeing
Synology hasn't named a ransomware family. The Hacker News reported that customers say their devices were hit by C3RB3R ransomware, which renames encrypted files with a .L0CK3D extension. Those are customer reports. Synology has not confirmed them, and it has not said who is behind the attacks or how many devices were hit.
Notice the page address of Synology's own statement: it includes the string "C3RB3R." That fits the customer reports, but the statement's text never names the malware, so treat the link between the two as unconfirmed until Synology says more.
Why NAS boxes keep getting hit
Ransomware crews have gone after consumer and small-business NAS devices for years. The Hacker News pointed to earlier campaigns such as eCh0raix (also called QNAPCrypt) in 2019 and StealthWorker in 2021. The reasons haven't changed. A NAS holds exactly the files a small office can't afford to lose: shared documents, accounting data and, all too often, the backups themselves. These boxes also tend to be set up once and then ignored. Some are reachable from the internet for remote access, and many go months or years without a firmware update.
This campaign fits that pattern. A fix has been available since late 2024. Any box that got hit this autumn had been missing a fix that was available for nearly two years.
What It Means for Defenders
Who is affected: According to Synology, anyone running a Synology NAS on a DSM version older than the fixed builds in Synology-SA-24:20. Per the NVD record, Synology BeeStation OS (BSM) before 1.1-65374 is also affected by CVE-2024-10441.
What to patch: The advisory lists these fixed versions. Get to one of them or anything newer:
- DSM 7.2.2-72806-1 or above
- DSM 7.2.1-69057-6 or above
- DSM 7.2-64570-4 or above
- DSM 7.1.1-42962-7 or above
- DSM 6.2.4-25556-8 or above
Synology says updating is the only fix. The advisory offers no mitigation other than installing the patch, so there's no setting you can change to hold off the risk while you delay.
Turn on automatic updates. Synology's statement specifically recommends this. Devices left unpatched for nearly two years suggest that relying on someone to remember doesn't work.
Keep the NAS off the public internet. If remote access is needed, put the device behind a VPN or a similar gated access method instead of exposing its management interface or services directly. A box attackers can't reach is much harder to exploit, even when it's behind on updates.
Check whether you've already been hit. If you run an older DSM build and it was exposed, look for files renamed with the .L0CK3D extension that customers have reported. Look for unfamiliar accounts, scheduled tasks or installed packages too. Patching blocks new break-ins. It does not remove an intruder who is already inside. If you find signs of compromise, isolate the device before you try to clean it up. Then change the passwords for the NAS admin accounts and for any credentials stored on or synced through the device.
Don't let the NAS be your only backup. When ransomware encrypts a NAS, it also encrypts every backup stored on it. Keep at least one copy offline or on separate, immutable storage that a compromised NAS can't overwrite.
For CMMC and other compliance programs: A file server holding controlled data that has gone nearly two years without a critical patch is a clear flaw-remediation finding. Add NAS firmware to the same patch tracking and asset inventory you use for servers and endpoints. Small storage appliances are often missing from that tracking.
