Loading story…
Synology disclosed CVE-2024-10441, a critical improper encoding or escaping of output flaw in the system plugin daemon affecting multiple products, including BeeStation Manager, DiskStation Manager (DSM), and Unified Controller/DSMUC. The vulnerability can let a remote attacker execute arbitrary code without user interaction, and public advisories warned that successful exploitation could also enable unauthorized file access and modification, raising the risk of full device compromise and data exposure.
Synology issued patched releases across affected BeeStation OS, DSM, and DSMUC branches, while national CERT guidance urged organizations to update exposed appliances immediately. Additional recommended mitigations included segmenting Synology devices from untrusted networks, restricting access with firewalls, monitoring for suspicious activity, and conducting regular vulnerability scans to identify unpatched systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Synology made patched versions available for affected BeeStation OS, DSM, and DSMUC branches, including DSM 6.2.4-25556-8, DSM 7.1.1-42962-7, DSM 7.2-64570-4, DSM 7.2.1-69057-6, DSM 7.2.2-72806-1, DSMUC 3.1.4-23079, and BeeStation OS 1.1-65374 or later. Synology advised customers to update immediately.
Synology disclosed CVE-2024-10441, a critical improper encoding or escaping of output flaw in the system plugin daemon affecting BeeStation Manager, DiskStation Manager, and Unified Controller. The company said the issue could allow remote code execution without user interaction and could also enable unauthorized file access and modification.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Synology addressed a critical remote code execution vulnerability (CVE-2025-12686) in its BeeStation product after the flaw was publicly demonstrated at the Pwn2Own Ireland 2025 competition. The vulnerability, which received a CVSS score of 9.8, stems from improper buffer size checks that allow remote attackers to execute arbitrary code on affected devices. Synology has released patches for all versions of BeeStation OS, urging users to upgrade to version 1.3.2-65648 or later to mitigate the risk. The flaw was one of several zero-days showcased at Pwn2Own Ireland 2025, where researchers were awarded over $1 million for discovering 73 unique vulnerabilities across a range of consumer and enterprise devices. The event highlighted the ongoing risks posed by zero-day vulnerabilities in widely used storage and smart home products. Other vendors, including QNAP, also issued patches for vulnerabilities revealed during the competition.
Jun 29, 2026
Synology disclosed three vulnerabilities in **MailPlus Server** for DiskStation Manager (**DSM**), including two **Critical** flaws that can let attackers read or write arbitrary files and trigger denial-of-service conditions. The most severe issue, `CVE-2026-13136`, carries a **CVSS 10.0** rating and can be exploited remotely without authentication, while `CVE-2025-15660` can be abused by an adjacent attacker for similar file access and service disruption. A third flaw, `CVE-2026-13135`, is rated Moderate and can allow remote attackers to access internal services. The advisory affects MailPlus Server deployments on **DSM 7.3, 7.2.2, and 7.2.1**. Synology said there is **no mitigation or workaround** other than upgrading to the fixed releases, directing customers to update to **4.0.1-31663** or **4.0.1-21663** depending on platform version. Organizations using Synology MailPlus Server are being urged to patch immediately because the exposed attack paths include unauthenticated remote exploitation and arbitrary file operations.
Jul 12, 2026
Western Digital has addressed a critical security vulnerability, tracked as CVE-2025-30247, affecting its My Cloud network-attached storage (NAS) devices. This flaw is an OS command injection vulnerability present in the firmware’s user interface, which allows remote attackers to execute arbitrary system commands by sending specially crafted HTTP POST requests. The vulnerability is notable for not requiring any prior authentication or user interaction, making exploitation straightforward for remote attackers. Successful exploitation could result in full system compromise, granting attackers access to all data stored on the affected NAS device, with the potential to encrypt, delete, or modify files. Additionally, a compromised device could serve as a launchpad for further attacks against other systems on the same network, increasing the risk to both home and small business environments where these devices are commonly deployed. The vulnerability affects My Cloud firmware versions prior to v5.31.108, which was released on September 23, 2025. Impacted models include My Cloud PR2100, PR4100, EX2 Ultra, EX4100, Mirror Gen 2, EX2100, DL2100, DL4100, WDBCTLxxxxxx-10, and My Cloud. Western Digital has urged all users to promptly update their devices to the latest firmware to mitigate the risk, noting that devices with automatic updates enabled should already be protected unless disconnected or powered off. The vulnerability was privately reported by a security researcher, and as of the latest reports, there is no evidence of exploitation in the wild. The CVSS score for this vulnerability is 9.3, reflecting its critical severity and the ease with which it can be exploited remotely. Security advisories emphasize the importance of immediate action, as unpatched devices remain highly vulnerable to remote compromise. The flaw underscores the ongoing risks associated with network-connected storage devices, particularly those exposed to the internet or used in environments with sensitive data. Western Digital’s response has included direct notifications to users and detailed instructions for applying the necessary firmware updates. The company’s Product Security Incident Response Team (PSIRT) has been credited as the source of the official advisory. Organizations and individuals using affected My Cloud NAS devices are strongly advised to verify their firmware version and apply updates without delay to prevent potential breaches. The incident highlights the critical need for timely patch management and the risks posed by unauthenticated remote code execution vulnerabilities in widely deployed storage solutions.
Jun 29, 2026