CONNECT WITH US
Gaming

Gaming

Got a Synology NAS? Time to check your updates, as two high-level vulnerabilities let ne’er-do-wells read and write files and conduct DDOS attacks

PC Gamer logo

Published on

Add as a preferred source on Google
Got a Synology NAS? Time to check your updates, as two high-level vulnerabilities let ne’er-do-wells read and write files and conduct DDOS attacks

Another day, another cybersecurity update. This time, it's the turn of immensely popular NAS provider Synology to advise its users about some now-fixed gaping holes. The company has updated its DiskStation Manager (DSM) operating system, patching out two security vulnerabilities in various product versions.

Just another patch? Not quite. The first of these vulnerabilities has a CVSS3 base score of 9.8 out of 10, which makes it of "critical" severity (via International Cyber Digest on X). According to the company:

"An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM)... allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks."

That's a pretty big security hole if I've ever seen one, particularly for those storing extremely important data on their home NAS setup. The second one gets a lower severity rating of 8.6, but also manages to allow attackers to skip the login process.

Synology describes the second vulnerability as "An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager," which can again lead to unwanted reads, writes, and DDOS shenanigans.

‼️BREAKING: A critical flaw in Synology NAS devices lets attackers read and write any file on them without logging in.The SQL injection bug in their login system scores 9.8 out of 10. A second flaw, in rsync, skips the login too.Synology patched both today. Update ASAP. https://t.co/LlS328SBf4November 11, 2026

The company also notified users late last month of ransomware attacks related to a 2024 security advisory , for what looks to be a series of separate vulnerabilities.


Source link
Related Topics:Gaming

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.