As Synology explains in security advisories published two days after the flaws were demoed at Pwn2Own Ireland 2024 to hijack a Synology BeeStation BST150-4T device, the security flaws enable remote attackers to gain remote code execution as root on vulnerable NAS appliances exposed online.
“The vulnerability was initially discovered, within just a few hours, as a replacement for another Pwn2Own submission. The issue was disclosed to Synology immediately after demonstration, and within 48 hours a patch was made available which resolves the vulnerability,” Midnight Blue said.
From a different source:
Synology proactively sponsors and works with security researchers as part of product security initiatives. At this year’s Pwn2Own Ireland 2024 event, which took place in late October, we successfully discovered and resolved multiple security vulnerabilities.
While these vulnerabilities are not being exploited, we recommend all Synology device administrators immediately take action to secure their systems by updating due to the scope and severity of specific issues.
And this was how I learned that Video Station is no longer supported by Synology. If you want the updates, you’ll have to uninstall it.
Synology supports docker containers. Just run jellyfin.
Jellyfin is also available as a native DSM package through SynoCommunity, FWIW.
To that note, anyone have any idea how to get Hyper Backup to stop telling me that my backups are “partial” because Video Station is no longer found? It’s not even on the list of apps, but tells me that it’s been disabled as an option to back up because it’s not available. Annoying!
Open hb, edit the affected backup plan, change nothing, okay/save. Happens when you set up a service to be backed up and then uninstall the service.
Brilliant! That worked!
There are scripts on github to reverse the change once you have done the update.