Photo credit: www.techradar.com
Synology addresses critical zero-click vulnerabilities in its NAS devicesExploits can occur without any user interaction$260,000 awarded for the discovery of security flaws
Synology has announced the release of critical security patches aimed at rectifying significant vulnerabilities in its network-attached storage (NAS) products, which had the potential to allow cybercriminals to take control of the devices.
The updates were detailed in two official advisories concerning security issues related to Photos for DMS and BeePhotos for BeeStation.
The vulnerabilities, showcased at the recent Pwn2Own Ireland 2024 event, could lead to remote code execution, which represents a critical risk since it permits attackers to control affected units without the need for any user involvement.
Critical vulnerabilities disclosed
Remote code execution flaws pose a particularly severe threat as they enable malicious actors to execute nonsanctioned commands on vulnerable devices, thus jeopardizing sensitive information.
By rectifying these vulnerabilities, Synology aims to fortify its users’ defenses against potential breaches. The updates not only hinder unauthorized remote access but also diminish the risks of ransomware attacks, data theft, and similar threats targeting NAS devices.
Given that many NAS systems contain sensitive data and are frequently connected to the internet, they become prime targets for cyberattacks. Therefore, the implementation of routine security updates is fundamental in shielding these devices from threats.
The Pwn2Own Ireland 2024 competition, coordinated by Trend Micro’s Zero Day Initiative (ZDI), recognized white-hat hackers with over $1 million for successfully demonstrating various exploits on different devices, including NAS units, cameras, and smart speakers.
Synology was among the companies whose products were deemed vulnerable, resulting in researchers earning a total of $260,000 for uncovering these critical security issues. The company’s prompt action following the event’s findings underscores its commitment to addressing security concerns swiftly.
Source: SecurityWeek
Related Articles
Source
www.techradar.com