Zero-Click Flaw Exposes Potentially Millions of Popular Storage Devices to Attack

Researchers identified a critical Synology NAS vulnerability disclosed via Pwn2Own and patched by Synology, but many cloud-connected NAS devices—including those owned by police departments, law firms, and industrial operators—may remain unpatched because Synology devices lack automatic updates. The report highlights the risk that attackers could exploit the flaw to deploy ransomware, exfiltrate sensitive data, or recruit devices into botnets, and warns that the public patch makes it easier to reverse-engineer and develop exploits.