Monday, December 9, 2024

Grow Your Business and Join MarketWorld Marketplace and Create Your Own Store front

HomeCyberSecuritySynology Urges Patch for Critical Zero-Click RCE Flaw Affecting Millions of NAS...

Synology Urges Patch for Critical Zero-Click RCE Flaw Affecting Millions of NAS Devices

Nov 05, 2024Ravie LakshmananVulnerability / Data Security

NAS Devices

Taiwanese network-attached storage (NAS) appliance maker Synology has addressed a critical security flaw impacting DiskStation and BeePhotos that could lead to remote code execution.

Tracked as CVE-2024-10443 and dubbed RISK:STATION by Midnight Blue, the zero-day flaw was demonstrated at the Pwn2Own Ireland 2024 hacking contest by security researcher Rick de Jager.

RISK:STATION is an “unauthenticated zero-click vulnerability allowing attackers to obtain root-level code execution on the popular Synology DiskStation and BeeStation NAS devices, affecting millions of devices,” the Dutch company said.

The zero-click nature of the vulnerability means it does not require any user interaction to trigger the exploitation, thereby allowing attackers to gain access to the devices to steal sensitive data and plant additional malware.

Cybersecurity

The flaw impacts the following versions –

Additional technical details about the vulnerability have been currently withheld so as to give customers sufficient time to apply the patches. Midnight Blue said there are between one and two million Synology devices that are currently simultaneously affected and exposed to the internet.

QNAP Patches 3 Critical Bugs

The disclosure comes as QNAP resolved three critical flaws affecting QuRouter, SMB Service, and HBS 3 Hybrid Backup Sync, all of which were exploited during Pwn2Own –

  • CVE-2024-50389 – Fixed in QuRouter 2.4.5.032 and later
  • CVE-2024-50387 – Fixed in SMB Service 4.15.002 and SMB Service h4.15.002, and later
  • CVE-2024-50388 – Fixed in HBS 3 Hybrid Backup Sync 25.1.1.673 and later

While there is no evidence that any of the aforementioned vulnerabilities have been exploited in the wild, users are advised to apply the patches as soon as possible given that NAS devices have been high-value targets for ransomware attacks in the past.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.




Source link

Bookmark (0)
Please login to bookmarkClose
RELATED ARTICLES
- Advertisment -spot_img

Most Popular

Sponsored Business

- Advertisment -spot_img