⚠ The paper trailUpdated 2026-11-01
NAS CVE Timeline — The Vulnerabilities Behind Every Campaign, By Vendor
Every campaign has a paper trail. This is the confirmed record — advisory by advisory, CVE by CVE — of the vulnerabilities NAS attackers actually used, sorted by vendor, each with its fixed version and real-world outcome. If your firmware predates a fix in your row, that's your to-do.
Synology
| Advisory / CVE | What it is | Fixed | Outcome |
|---|---|---|---|
| SA-26:13 — CVE-2026-13639, CVE-2026-13684 (+ CVE-2026-13635/13673/13623/13683, CVE-2026-6205/13666) | Eight DSM flaws; the first two are unauthenticated file read/write (CVSS 9.8) | 2026-09-18: DSM 7.4-90075 / 7.3.2-86009-4 / 7.2.2-72806-9 / 7.2.1-69057-12 | Used by C3RB3R per Qihoo 360 — devices unpatched 6 weeks later got encrypted |
| SA-24:20 — CVE-2024-10441 | Unauthenticated remote code execution (CVSS 9.8), found at Pwn2Own 2024 | December 2024 DSM updates | Synology says the 2026 campaign exploited this on boxes still unpatched ~2 years later |
| PHP2Shell — CVE-2026-109618 / CVE-2026-109619 | Critical flaws in PHP itself hitting Synology packages (Web Station, WordPress, Mail Station…) | PHP package updates via Package Center, down to DSM 6.2 | Actively exploited; CISA KEV listed 2026-10-26 — separate from the ransomware |
QNAP
| Advisory / CVE | What it is | Fixed | Outcome |
|---|---|---|---|
| QSA-21-57 | The flaw behind DeadBolt wave 1 | QTS 5.0.0.1891 / 4.5.4.1892, QuTS hero h5.0.0.1892 (Jan 2022) | DeadBolt hit unpatched devices starting 12 days after the fix; ~5,000 infections |
| QSA-22-02 | DeadBolt campaign advisory (.deadbolt extension, hijacked login page) | Same fixed builds; Malware Remover quarantines the note after upgrade | Three waves by May 2022, the last targeting EOL QTS 4.3.6/4.4.1 |
| Qlocker (2021) | Files packed into password-protected 7z | QTS updates + Malware Remover, April 2021 | Thousands of victims in days; no public decryptor emerged |
TerraMaster
| CVE | What it is | Fixed | Outcome |
|---|---|---|---|
| CVE-2022-24990 + CVE-2022-24989 | webNasIPS info leak (incl. admin password hash) chained with createRaid command injection = unauthenticated root RCE | TOS 4.2.30 (2022-03-01) | Disclosed by Octagon Networks; same release also fixed the flaw behind TerraMaster's DeadBolt infections |
How to read this page
Three observations worth internalizing: (1) every exploited flaw was already fixed — victimhood is a patch-latency problem, not a discovery problem; (2) severity scores don't predict campaigns — simple file read/write (13639) encrypted more data than exotic RCE chains; (3) the checklist neutralizes all rows at once. New advisories get added here as vendors publish them.
FAQ
My model isn't listed in any row. Am I safe?
The page lists flaws behind actual campaigns, not every advisory ever published. Check your vendor's own security advisory page for your firmware branch — and run the checklist regardless; exposure matters as much as CVE lists.
Why do attacks happen after patches, not before?
Patches are the trigger: once a fix ships, attackers reverse it to find the flaw, then sweep everyone who hasn't updated. DeadBolt waited 12 days; C3RB3R's victims were 6 weeks to 2 years behind. The gap between 'fixed' and 'patched on your box' is where every victim lived.
What's a CVSS 9.8 in plain words?
Roughly: remotely exploitable, no authentication needed, full impact. It's the score that means 'anyone on the internet can do this to an unpatched box' — which is why the table's 9.8 rows all ended in mass campaigns.