Synology patches two DSM flaws that let remote attackers read, write and disrupt NAS devices

Owners of Synology NAS units should install the latest DiskStation Manager builds now, since the more serious flaw is rated 9.8 out of 10.

Synology has shipped an update to its DiskStation Manager operating system that closes two security flaws affecting several product versions. The more serious of the two, rated 9.8 out of 10 on CVSS3, is an SQL injection in the Auth API that lets remote attackers read or write arbitrary files and launch denial-of-service attacks. A second flaw, rated 8.6, is an authentication bypass in rsync that allows attackers to skip login and carry out similar reads, writes and disruption. Synology also told users late last month about ransomware attacks linked to a 2024 advisory, which may point to a set of separate vulnerabilities. Owners of Synology NAS devices, particularly those storing important data at home, should confirm they are running the newest builds.