Synology released out-of-band security updates addressing CVE-2024-10443 (CVSS 9.8), an unauthenticated OS command injection flaw dubbed RISK:STATION affecting Synology Photos and BeePhotos for BeeStation. Residing in the applications’ Task Manager component, the vulnerability stems from improper input neutralization (CWE-78) when parsing network requests. Remote unauthenticated adversaries can trigger the flaw without user interaction, achieving zero-click arbitrary command execution with root privileges on target network-attached storage appliances.

Demonstrated by Midnight Blue researcher Rick de Jager at Pwn2Own Ireland 2024 to compromise a BeeStation BST150-4T, the flaw exposes millions of internet-connected devices—including units across law enforcement and critical infrastructure contractors—to remote hijacking and ransomware extortion. Synology released security updates in Synology Photos 1.7.0-0795 and 1.6.2-0720, and BeePhotos 1.1.0-10053 and 1.0.2-10026. Because these updates do not install automatically, administrators must manually apply vendor packages.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Unauthenticated root-level command injection via default media services bypasses boundary access controls and provides complete device takeover without credential requirements or operator interaction, enabling immediate firmware tampering and disk-level data access.
• Bullet 2 — Strategic & Defender Imperative: Storage administrators must manually deploy application updates across all Synology DSM and BeeStation devices immediately, disable public WAN forwarding for ports 5000/5001, and isolate storage management interfaces behind authenticated VPNs.