A critical “zero-click” vulnerability in Synology NAS software was recently discovered by Rick de Jager, a Dutch security researcher from Midnight Blue. This happened during the Pwn2Own hacking competition in Ireland. The vulnerability is in Synology’s pre-installed Photos app and BeePhotos software for BeeStation. A “zero-click” vulnerability means that an attack can occur without any user action and without authentication. This allows attackers to remotely access and take full control of the device. They can even install and execute code.
Millions of vulnerable devices
After the discovery, Midnight Blue immediately informed Synology. Within 48 hours, Synology released a patch to fix the problem. Midnight Blue stressed the importance of users updating their devices quickly, as millions of devices are vulnerable. However, Synology devices do not update automatically, requiring manual updating.
NAS systems are a popular target for attacks due to the large amount of personal data they contain. Therefore, it is very important to install updates quickly.