Root via Telnet: Why You Must Patch Your Synology NAS Against This Decade-Old Ghost

Synology released critical firmware updates on January 29, 2026 addressing CVE-2026-24061, a vulnerability in the DSM telnetd terminal service that the vendor rates as Critical/High-Risk. The advisory lists affected DSM 7.2/7.3 series and required patch versions, warns that the flaw exists in core system files even when Telnet is disabled, and urges immediate updating to mitigate potential local privilege escalation.