If you run a Synology NAS, check that its DiskStation Manager (DSM) operating system has installed the latest update. Synology has patched two vulnerabilities, and the worse one is rated 9.8 out of 10 on the CVSS3 severity scale, which puts it in the "critical" tier. Check Synology's advisory for the affected versions and the fixed build numbers that apply to your model.
The critical bug is an SQL injection flaw in the DSM Auth API. SQL injection means a system treats attacker-supplied text as a database command. Synology said it "allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks." International Cyber Digest, a security account on X, said on November 11 that it works without logging in, and that Synology patched both flaws that day.
The second flaw scores 8.6. Synology describes it as an authentication bypass using an alternate path or channel in rsync, the file-sync tool, and says it can also lead to unwanted reads, writes and denial-of-service attacks. In plain terms, one bug breaks the login code and the other walks around it.
The location of the first flaw is what makes it serious. The Auth API is the code that decides who gets in, so a mistake there sits at the front door. A NAS often holds the backups and archives people can least afford to lose, which raises the cost of a break-in well beyond one machine.
This is separate from the ransomware warning Synology sent users late last month. That notice concerned attacks related to a 2024 security advisory covering a different set of vulnerabilities. Many users have reportedly already received the new update, but automatic updaters are far from perfect, so a manual look at the installed DSM version is a few minutes well spent.