As Synology explains in security advisories published two days after the flaws were demoed at Pwn2Own Ireland 2024 to hijack a Synology BeeStation BST150-4T device, the security flaws enable remote attackers to gain remote code execution as root on vulnerable NAS appliances exposed online.
“The vulnerability was initially discovered, within just a few hours, as a replacement for another Pwn2Own submission. The issue was disclosed to Synology immediately after demonstration, and within 48 hours a patch was made available which resolves the vulnerability,” Midnight Blue said.
From a different source:
Synology proactively sponsors and works with security researchers as part of product security initiatives. At this year’s Pwn2Own Ireland 2024 event, which took place in late October, we successfully discovered and resolved multiple security vulnerabilities.
While these vulnerabilities are not being exploited, we recommend all Synology device administrators immediately take action to secure their systems by updating due to the scope and severity of specific issues.
If you are using any Synology products with your setup, you should go ahead and apply the recommended updates
2/2 otters agree with this course of action.
Voice of reason
Was it that the talk was a last minute change (replacing another scheduled talk) so the responsible disclosure was made in a rush without giving synology more time to provide the patch before the talk was presented?
If so, who decided it was a good idea to present something regarding a vulnerability without the fix being available yet?
The vulnerability was discovered during a pwn2own competition. The competition was endorsed and probably sponsored by Synology. Not sure what the problem is?
And this was how I learned that Video Station is no longer supported by Synology. If you want the updates, you’ll have to uninstall it.
If someone knows how to apply security updates to ancient NAS from the brand I’m interested. Sadly mine is out of the loop, I guess I’ll have to harden it like hell then
The solution is to not use EOL software
