FlagThis

Security researchers discovered a critical zero-click vulnerability within Synology’s Photos app, impacting millions of users. This vulnerability allows attackers to compromise the system without any user interaction. The flaw resides in a part of the app that doesn’t require authentication, enabling direct exploitation over the internet. Attackers can gain root access and install malicious code, potentially turning the infected device into a botnet for further nefarious activities. Synology has addressed the bug, but users need to manually update their devices. This incident highlights the importance of regularly updating software to mitigate security risks and the growing threat of zero-click vulnerabilities.

References:

• Engadget is a web magazine with obsessive daily coverage of everything new in gadgets and consumer e - Security researchers found a serious zero-click bug in Synology's Photos app that allows hackers to compromise a system without a user needing to click something first. - 5d
• www.synology.com - Synology's security advisory detailing the vulnerability in the Photos app. - 5d
• Wired - A new zero-click vulnerability in the Synology Photos app poses a serious threat to users of the popular NAS devices. - 5d
• Malware Analysis, News and Indicators - Satori Threat Intelligence and Research team published findings about a group of cybercriminals that infect legitimate web shops to create and promote fake product listings. - 5d
• @jos1264 - 1,000+ web shops infected by “Phish ‘n Ships” criminals who create fake product listings for in-demand products - 5d
• Company News - Satori Threat Intelligence and Research team published findings about a group of cybercriminals that infect legitimate web shops to create and promote fake product listings. - 5d
• Malwarebytes - Researchers at the Satori Threat Intelligence and Research team have published their findings about a group of cybercriminals that infect legitimate web shops to create and promote fake product listin - 5d
• @PrivacyDigest - Another Mastodon post by the same user summarizes the vulnerability in one sentence. - 4d

Classification:

• HashTags: cybersecurity synology zeroclick
• Company: Synology
• Target: Synology Users
• Product: Photos App
• Feature: Zero-Click Vulnerability
• Type: Vulnerability
• Severity: Major