CVE-2024-10443

Arctic Wolf Labs warns of CVE-2024-10443, a zero-click RCE in Synology Photos and BeePhotos that can allow unauthenticated remote root access on internet-exposed NAS devices (potentially hundreds of thousands to millions affected). Synology has released fixes; Arctic Wolf recommends upgrading to the fixed versions and, where appropriate, disabling QuickConnect for the Photo application while noting no observed active exploitation to date but a high likelihood of threat actors — including ransomware groups — attempting to reverse-engineer patches and exploit the flaw.