Synology Patches Critical DSM Flaws Affecting NAS Units Used For CCTV Recording And Storage.
Synology Patches Critical DSM Flaws – Synology has released an update for its DiskStation Manager (DSM) operating system that fixes 8 vulnerabilities. Two are rated a critical CVSS 9.8, and unauthenticated remote attackers can exploit both to read or write arbitrary files and cause denial of service.
Plenty of Australian video surveillance systems record to Synology NAS units running Surveillance Station, and many more use them to archive footage from other VMS platforms. If you’ve installed or maintain any of them, this update belongs on this month’s to-do list – the advisory lists no workaround, only the patch.
SYNOLOGY has carved out a solid place in the security market over the years. Its NAS units run Surveillance Station at countless small and mid-sized sites, its DVA deep-learning recorders sit in comms rooms around the country, and plenty of integrators use DiskStations as cheap, capable archive storage behind their VMS of choice. All of that runs on DSM, which is why advisory Synology-SA-26:13 deserves attention from security installers, not just IT teams.
Synology published the advisory on September 18 and rated it Critical. The 2 serious flaws are:
Why This Matters For CCTV
Think about what sits on a recording NAS. It holds weeks or months of footage, and sometimes footage that’s been exported as evidence. It holds the camera credentials Surveillance Station uses to pull streams, and often network shares used by the rest of the business. A flaw that lets a remote attacker write arbitrary files to that box is about as bad as it gets for system integrity – and the integrity of recorded video is exactly what end users and police rely on when something goes wrong.
Singapore’s Cyber Security Agency issued its own alert on September 23, advising users and administrators to update immediately. At the time of writing we haven’t seen reports of these flaws being exploited in the wild. Having said this, NAS units exposed to the internet have long been a favourite target – ransomware campaigns such as eCh0raix have hit internet-facing NAS boxes before – and the gap between a published patch and working attacks keeps getting shorter.
What Should Installers Do?
The first job is simple: log in to every Synology unit you look after and check the DSM version against the list above. Don’t assume auto-update has done the job – many recording NAS units have it switched off precisely so a firmware update doesn’t interrupt recording overnight. Schedule the update, let it reboot, then check every camera is back and recording.
Something to note is that the advisory only lists fixes for DSM 7.2.1 and later. If you’ve still got older DiskStations quietly recording cameras in a back room somewhere, it’s worth checking where they sit with Synology’s support lifecycle – and having a conversation with the customer about replacement.
The second job is the one that actually reduces risk over time. We’d keep DSM’s management interface off the open internet – no port forwards to ports 5000 and 5001, and remote access via VPN or Synology’s own relay services instead. We’d put recording NAS units on a separate camera VLAN, away from office PCs. And we’d make sure footage that matters is backed up somewhere an attacker on the NAS can’t reach.
SEN’s View
In fairness to Synology, it published a clear advisory with fixed versions across 4 DSM branches at once, and that’s how it should be done.
The bigger issue, in our opinion, is the same one we raised with Ubiquiti’s recent bulletin. Recording NAS units tend to be installed, tuned and forgotten. They’re often owned by nobody in particular – too “IT” for the security contractor and too “security” for the IT provider. When the device holding a site’s video evidence has a 9.8 vulnerability, that grey zone needs closing, and the security installer is often best placed to close it.
You can read Synology’s security advisory SA-26:13 here or read more SEN news here.
FEATURES: Synology-SA-26:13 At A Glance
- 8 vulnerabilities fixed in DSM
- 2 rated critical CVSS 9.8, exploitable remotely without authentication
- Arbitrary file read/write and denial of service
- Fixed in DSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 and 7.2.1-69057-12
- No mitigation – update required
