Synology NAS Under Mass Attack via CVE-2024-10441: C3RB3R Ransomware Targets Unpatched DSM Devices

Quick answers

• Three vulnerabilities — CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445 — in the DSM operating system of Synology NAS devices are being actively exploited to install the C3RB3R ransomware on machines still running old, unpatched DSM versions.
• CVE-2024-10441 is the most dangerous (CVSS 9.8/10): an unauthenticated remote code execution (RCE) flaw — attackers take control of the NAS without needing any account at all.
• Signs of a C3RB3R infection: files on the NAS renamed with a .L0CK3D extension and a ransom note file named read-me3.txt.
• All three flaws were patched back in late 2024 (advisory Synology-SA-24:20). The machines being hit are the ones that never upgraded DSM to the patched builds: 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, 6.2.4-25556-8, or BeeStation OS 1.1-65374 and later.
• What to do now: check your DSM version and update to the newest build of your branch, enable automatic updates, stop exposing the DSM management interface to the Internet, and keep an offline backup following the 3-2-1 rule.

What are a CVE and unauthenticated RCE?

A CVE (Common Vulnerabilities and Exposures) is the international identifier assigned to each publicly disclosed security flaw, such as CVE-2024-10441. RCE (Remote Code Execution) is a class of vulnerability that lets an attacker run arbitrary code on the victim device remotely. When an RCE flaw is also "unauthenticated" — requiring no account, password or prior login — it becomes the most dangerous scenario of all: anyone who can reach the device over the network can seize control of it, as is the case with CVE-2024-10441 on Synology NAS.

What is happening to Synology NAS devices?

The three vulnerabilities belong to advisory Synology-SA-24:20, originating from the Pwn2Own 2024 competition. Synology published the advisory in November 2024 and completed the patches around December 2024. In other words, these are not new flaws — the fixes have existed for nearly two years.

The problem is that a great many NAS devices still run old DSM builds that were never updated. According to the original author's roundup, since late October 2026 these vulnerabilities have been exploited in the wild in a wave of attacks: attackers scan for Synology NAS devices that are still vulnerable, exploit CVE-2024-10441 to break in, and deploy ransomware known as C3RB3R. Data on the NAS is encrypted, file extensions are changed to .L0CK3D, and a read-me3.txt ransom note is left behind.

This is a familiar attack pattern: cybercriminals do not need expensive zero-day exploits — they only need vulnerabilities that already have patches, on the many devices out there whose owners never applied them.

How dangerous is CVE-2024-10441?

CVE-2024-10441 scores 9.8 out of 10 on the CVSS scale, the critical severity level and the highest of the three flaws, with the attack vector AV:N/AC:L/PR:N/UI:N — network-exploitable, low complexity, no privileges required and no user interaction needed.

Technically, it is an improper encoding or escaping of output flaw (CWE-116) in the system plugin daemon. As summarized in the original post, the attacker sends a specially crafted request to a web API endpoint (typically /webapi/entry.cgi), abusing the account parameter to inject environment variables (such as LD_PRELOAD or LD_DEBUG_OUTPUT) into a high-privilege plugin process, and from there executes malicious shell commands or scripts.

In practice, this is the very flaw used to deploy the C3RB3R ransomware. As long as the NAS's web API is reachable from the Internet and DSM is unpatched, an attacker can walk straight in without stealing anyone's password.

What can CVE-2024-50629 and CVE-2024-10445 do?

CVE-2024-50629 (CVSS 5.3, Medium) is also an improper output-encoding flaw, but located in the webapi component. It allows a remote, unauthenticated attacker to read certain restricted files on the system — an information disclosure issue. On its own it cannot seize the machine, but it is commonly combined with other flaws to gather information before a deeper attack.

CVE-2024-10445 (CVSS 4.3 per Synology; some NVD sources score it 5.3) is an improper certificate validation flaw (CWE-295) in the update function. It allows an attacker in a man-in-the-middle position on an adjacent network (vector AV:A — Adjacent Network) to write certain restricted files through the update process. It is less dangerous than the other two because it requires a network position close to the victim.

Vulnerability	CVSS score	Flaw type	Exploitation requirements	Impact
CVE-2024-10441	9.8 (Critical)	Improper encoding/escaping of output (CWE-116) in the system plugin daemon	Remote over the network, no login required	Arbitrary code execution (RCE) — the main flaw used to install the C3RB3R ransomware
CVE-2024-50629	5.3 (Medium)	Improper encoding/escaping of output in webapi	Remote over the network, no login required	Reads certain restricted files; information disclosure
CVE-2024-10445	4.3 (per Synology) / 5.3 (per NVD)	Improper certificate validation (CWE-295) in the update function	Attacker on an adjacent network (man-in-the-middle)	Writes certain restricted files via the update process

Which DSM versions are affected, and what should you update to?

Every DSM build below the patched milestone of its branch is at risk. The table below lists the minimum patched versions containing the SA-24:20 fixes:

Product / DSM branch	Minimum patched version
DSM 7.2.2	7.2.2-72806-1 or later
DSM 7.2.1	7.2.1-69057-6 or later
DSM 7.2	7.2-64570-4 or later
DSM 7.1	7.1.1-42962-7 or later
DSM 6.2	6.2.4-25556-8 or later (mainly for CVE-2024-10445)
BeeStation OS (BSM)	1.1-65374 or later

One important note for today: beyond the SA-24:20 patches, users should update to the newest build of the DSM branch they are running — later advisories such as SA-26:13 (September 2026) patch additional vulnerabilities, and a machine that is merely "new enough for 2024" can still be targeted through newer flaws. For older models capped at a lower DSM branch (for example, limited to DSM 7.1), you still need to reach that branch's patched milestone, while tightening Internet access as recommended below.

What should Synology NAS owners do right now?

1. Check your current DSM version: open Control Panel → Update & Restore on the NAS and compare it against the patched-version table above.
2. Update immediately to the newest available build for your DSM branch — do not stop at the SA-24:20 minimum if a newer build exists.
3. Enable automatic updates so important security patches are installed in time instead of depending on someone remembering to check manually.
4. Do not expose the DSM management interface to the Internet: remove unnecessary port forwarding; when remote access is needed, prefer a VPN or QuickConnect with its protective options fully enabled.
5. Back up with the 3-2-1 rule and keep at least one copy offline: ransomware on the NAS becomes pointless if your important data also exists in an offline copy the attacker cannot reach.

Why are flaws patched in 2024 still being exploited en masse in 2026?

Three main reasons stand behind this attack wave. First, a NAS is a "set it up and forget it" device: many units are configured once and then run for years with nobody watching security advisories. Second, the "if it works, don't touch it" mindset leads many administrators and users to postpone updates for fear of disruption — while that very postponement is the biggest risk of all. Third, many NAS devices have ports opened to the Internet for convenient remote access, inadvertently placing them within reach of automated scanning by cybercriminals worldwide.

The lesson is not limited to Synology users: for any network device — NAS, router, camera, firewall — a security patch only works when it is actually installed. A vulnerability patched nearly two years ago can still be the gateway for ransomware if your device is among those that were never updated.

Frequently asked questions

How do I know whether my Synology NAS is infected with the C3RB3R ransomware? The reported signature: files on the NAS renamed with the .L0CK3D extension and a read-me3.txt ransom note present. If you see these signs, disconnect the NAS from the network immediately and follow an incident-response process — do not keep using the machine as normal.

My NAS has no ports open to the Internet — can CVE-2024-10441 still hit it? The likelihood is far lower, because this flaw is exploited over the network to the NAS's web API. However, "no open ports" should be verified in practice — many users enabled QuickConnect, UPnP or port forwarding long ago and forgot. And CVE-2024-10445 is exploited from the local network, so applying the patches remains mandatory.

Where do I check and update the DSM version? In the DSM management interface: Control Panel → Update & Restore. This shows the current version and the newest update available for your model, and it is also where automatic updates can be enabled.

My model is older and can only run DSM 7.1 — is it patched? Yes — the DSM 7.1 branch has a patched milestone at 7.1.1-42962-7 and later. Upgrade to the highest build your model supports, minimize Internet access to the NAS (prefer a VPN), and maintain an offline backup, because older models will receive new patches less and less often.

My data has already been encrypted — should I pay the C3RB3R ransom? Paying does not guarantee you will get your data back, and it funds further crime. The recommended path is to restore from a clean offline backup, after updating DSM to a patched build and reviewing the entire remote-access configuration.

---

Source: the article by Tri Van Ho in the Synology Club group on Facebook, posted on November 5, 2026, compiled from advisory Synology-SA-24:20. Information about the exploitation wave of late October 2026 is cited from the original author's roundup.