Synology fixes further critical Pwn2Own vulnerabilities
Synology NAS were a popular target in the Pwn2Own competition in Ireland. The manufacturer is patching further critical vulnerabilities discovered there.
(Image: Bild erstellt mit KI in Bing Image Creator durch heise online / dmk)
Synology has published further security notifications regarding security vulnerabilities in the manufacturer's NAS systems, some of which are critical. These were discovered as part of the Pwn2Own competition in Ireland, which took place at the end of October.
The vulnerabilities affect Synology DSM, Synology Drive Server, Synology Replication Service and Synology BeeStation. With the exception of the Drive Server vulnerability, which was rated as "important" by Synology's developers, all vulnerabilities are considered a critical security risk. CVE vulnerability entries have not yet been assigned or published, and a CVSS system rating is also missing.
Synology vulnerabilities: only vague hints
The vulnerabilities are only vaguely hinted at in the security notifications. In Synology Beestation, attackers can execute arbitrary code from the network, read certain files or man-in-the-middle attackers can write certain files. Beestation 1.0 and 1.1 are affected, the upgrade to 1.1-65374 or newer corrects the errors. The replication service, on the other hand, allows attackers from the network to execute arbitrary commands. DSM 7.1 and 7.2 are vulnerable to this, the update to version 1.2.2-0353 and 1.3.0-0423 or newer corrects the errors. A security update for the vulnerable DSMUC 3.1 will be released within 30 days.
Videos by heise
Five security vulnerabilities in Synology DSM also allow attackers from the network to execute malicious code, read certain files or attackers in a man-in-the-middle position to access admin sessions or write certain files. The bug-fixed version 7.2.2-72806-1 or newer is only available for DSM 7.2; updates for the vulnerable DSM 7.1 and DSMUC 3.1 are to be released within the next 30 days. The vulnerability in Synology Drive Server, which is classified as "important", allows attackers from the network to take over web sessions and inject SQL commands. DSM 7.2 from version 3.5.1-26102 no longer contains the bug, an update for DSM 7.1 has been announced for the next 30 days.
Anyone using Synology NAS systems should ensure that they install the available updates promptly in order to minimize the attack surface.
Synology had already closed two security vulnerabilities in its NAS systems last week. The vulnerabilities in Synology Photos and BeePhotos have been classified as critical security risks by the developers.
(dmk)
