(Pwn2Own) Synology DiskStation Manager Netatalk Library Buffer Overflow RCE Vulnerability

TL;DR

Synology DiskStation Manager is vulnerable to a buffer overflow that enables RCE. No auth required, CVSS rating of 9.8.

What happened

["Buffer overflow vulnerability discovered in Synology DSM's Netatalk library", 'Permits remote code execution without authentication']

Why it matters for ops

['Exploits can be executed remotely', 'No user interaction or authentication needed to exploit the flaw']

Mitigation

• Update DSM to latest version with patch
• Disable unused services and apply strict firewall rules

Action items

• Check for updates immediately
• Monitor systems for suspicious activity

Detection IOCs

• Unusual network activity from Netatalk service port
• Unexpected remote code execution attempts in logs

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-187/