⚠ CVSS 9.8 CriticalUpdated 2026-10-31
CVE-2024-10441 Synology DSM Vulnerability — What It Is and the Exact Fix
A remote code execution flaw requiring no authentication. Synology's 29 October 2026 statement says attackers are exploiting this already-patched vulnerability against devices still running old DSM in the current ransomware campaign — proof that 'patched long ago' means nothing if you never installed the patch.
| Item | Detail |
|---|---|
| CVE | CVE-2024-10441 |
| Severity | 9.8 Critical |
| Affected | Synology DSM (multiple branches) |
| Status | found at Pwn2Own 2024, patched December 2024 (Synology-SA-24:20) |
| Fixed in | the December 2024 DSM update for your branch or later |
| Workaround | None listed — update, and keep the admin interface off the open internet |
Check whether you're patched
Open Control Panel → Info Center and read the DSM build number (e.g. 7.2.1-69057 Update 5). Compare it against the fixed builds above — if yours is lower, update immediately via Update & Restore, then enable automatic updates so this never silently repeats. If your model is end-of-life and cannot reach the fixed branch, isolate the NAS from the internet (firewall, no port forwards, no DMZ) — see the hardening checklist.
Context
This flaw is part of the October 2026 C3RB3R ransomware campaign against Synology NAS devices. The full incident page has the timeline, the encryption details, and recovery steps.
FAQ
Is CVE-2024-10441 being exploited right now?
Yes — it is one of the flaws cited in the October 2026 C3RB3R ransomware campaign against Synology NAS devices. Devices on patched builds are protected; devices below the fixed builds and exposed to the internet are at real risk.
How do I check my DSM build number?
Control Panel → Info Center shows the DSM version and build (for example 7.2.1-69057 Update 5). Compare against the fixed-build table on this page. Note: 7.2.1-69057 'Update 5' is LOWER than the fixed 7.2.1-69057-12 — the suffix matters.
I can't update (old model / DSM 6). What now?
Models end-of-life on DSM 6.x have no patch for these flaws. The safe posture is full isolation: remove port forwards, block WAN access to the admin UI, use VPN-only access if needed, and keep an off-NAS backup. See the hardening checklist.