# Synology Warns of Ransomware Attacks Targeting Outdated NAS Devices Attackers are exploiting unpatched vulnerabilities in older DSM versions to encrypt critical user data. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-11-03 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/77cce457-3e0c-4a8a-813f-c8a4fa8eb5ec ## Active Ransomware Campaign Detected Synology issued a critical warning on October 29, 2026, regarding ongoing ransomware attacks targeting its network-attached storage devices. Threat actors are actively exploiting vulnerabilities in outdated DiskStation Manager software to encrypt user files and demand extortion payments. The company identified these threats as specifically targeting systems running unpatched, legacy firmware versions. ## Vulnerability Advisory Context The attacks leverage security flaws documented in the Synology-SA-24:20 advisory, originally published on November 5, 2024. While Synology has not confirmed the specific entry point, the advisory covers three distinct vulnerabilities. These include flaws in the system plugin daemon, webapi components, and certificate validation processes that remain unpatched on many devices. ## Critical Security Flaw Details The most severe vulnerability, CVE-2024-10441, carries a CVSS score of 9.8, allowing unauthenticated remote attackers to execute arbitrary code. Other issues include CVE-2024-50629, which permits limited file reading, and CVE-2024-10445, involving improper certificate validation. These flaws represent significant risks to any NAS device that has not received the necessary software updates. ## Required Version Updates Administrators must verify their DSM version against specific minimum builds provided by the vendor. Required versions include 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, and 6.2.4-25556-8. Users running versions older than these thresholds are currently exposed to potential compromise and must prioritize manual updates to secure their data against these ongoing ransomware threats. ## Operational Impact of Encryption Ransomware infections on NAS devices pose severe risks to business continuity, as these systems often house shared operational files and critical backups. If attackers successfully encrypt this data, organizations lose access to essential information. Furthermore, recovery becomes significantly more difficult if the NAS device also contains the primary backups required to restore other systems. ## Automated Defense Strategies Synology strongly recommends that all users enable automatic updates to ensure future security fixes are applied without manual intervention. This proactive configuration reduces the window of exposure for devices that might otherwise remain vulnerable due to administrative oversight. Enabling this feature is now considered a fundamental requirement for maintaining NAS security integrity. ## Legacy System Risk Profile The current campaign highlights the persistent danger of maintaining legacy software long after vendors release patches. Even though fixes for these specific vulnerabilities were available as early as December 2024, many devices remain unprotected. This gap between patch release and deployment provides a reliable attack surface for threat actors targeting network storage. ## Security Posture Recommendations Beyond immediate patching, users should treat their NAS devices as high-value targets within their network infrastructure. Regularly auditing system logs and restricting remote access to management interfaces can further mitigate risks. Given the severity of these ransomware attacks, maintaining offline, immutable backups remains the most effective strategy for ensuring long-term data resilience. ## Sources covering this story - https://securityaffairs.com/202343/security/synology-warns-of-ransomware-attacks-targeting-nas-devices-running-outdated-dsm-versions.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._