Synology Photos RCE: Check These Pwn2Own Patches Now

Cybersecurity and Threat Intelligence

If your Synology NAS runs Photos or you manage a BeeStation using BeePhotos there is an older Pwn2Own vulnerability that is still worth checking today.

The issue is not a theoretical weakness requiring an attacker to already have an administrator password. CVE-2024-10443 was rated Critical with a CVSS score of 9.8 and could allow a remote attacker to execute arbitrary code without privileges or user interaction. Synology patched the affected packages following Pwn2Own Ireland 2024. For systems that have remained current, the immediate vulnerability has therefore been resolved.

The problem is older NAS installations, manually maintained packages, forgotten BeeStations, and systems exposed to the internet that may have missed the required update. If you administer Synology infrastructure, checking the installed package version should take priority over assuming that a system is safe simply because DSM itself appears current.

What Happened at Pwn2Own Ireland?

Security researchers from PHP Hooligans / Midnight Blue demonstrated a command-injection vulnerability against the Synology BeeStation BST150-4T during Pwn2Own Ireland in October 2024. The exploit achieved code execution and earned the researchers $40,000 during the competition. Synology subsequently documented the vulnerability as CVE-2024-10443.

The underlying problem involved improper neutralization of special elements used in a command within the Task Manager component shared by affected versions of Synology Photos and BeePhotos. In practical terms, specially crafted input could result in commands being executed on the affected system.

Why CVE-2024-10443 Was So Serious

Synology assigned the vulnerability a CVSS 3.1 base score of 9.8 out of 10. Its CVSS vector identifies several characteristics that should immediately concern administrators:

Network accessible: The attack could be conducted across a network.

Low complexity: Exploitation did not require unusually complicated conditions.

No privileges required: An attacker did not first need an authenticated account.

No user interaction: A legitimate user did not need to click a malicious attachment or approve an action.

High impact: Confidentiality, integrity, and availability could all be affected.

This combination is what makes remote code execution vulnerabilities particularly important on network-attached storage. A NAS frequently contains backups, photographs, business files, credentials, archives, and other valuable information. If the vulnerable service is reachable by an attacker, the consequences can extend far beyond the Photos application itself.

Which Synology Photos Versions Were Affected?

Synology’s advisory identifies affected Synology Photos releases and the versions containing the fix.

For Synology Photos on DSM 7.2, administrators should upgrade to:

Synology Photos 1.6.2-0720 or later

For Synology Photos on DSM 7.2.2, administrators should upgrade to:

Synology Photos 1.7.0-0795 or later

Synology lists Photos for DSM 7.1 as not affected by this particular CVE.

Current systems should already be far beyond these versions, but that is exactly why older installations deserve attention. A NAS that has not received package updates for an extended period should not be assumed safe based on its age or lack of obvious symptoms.

BeeStation Owners Need to Check BeePhotos Too

The same CVE affected BeePhotos.

Synology lists the fixed versions as:

BeePhotos for BeeStation OS 1.0: 1.0.2-10026 or later

BeePhotos for BeeStation OS 1.1: 1.1.0-10053 or later

Anything below those fixed versions should be treated as requiring an update. This is important because a BeeStation may not be managed with the same attention as a business DiskStation. A device purchased for convenient personal file and photo storage can still contain highly valuable information.

Don’t Confuse the Photos Patch With the DSM Pwn2Own Patch

There was more than one Synology security issue associated with Pwn2Own Ireland 2024. That distinction matters when checking an older NAS.

CVE-2024-10443 affected the Synology Photos and BeePhotos packages. Separately, Synology issued a critical DSM advisory covering CVE-2024-10441, another CVSS 9.8 remote-code-execution vulnerability affecting the underlying DSM/BSM system plugin daemon.

Synology’s fixed DSM releases included:

DSM 7.2.2-72806-1 or later
DSM 7.2.1-69057-6 or later
DSM 7.2-64570-4 or later
DSM 7.1.1-42962-7 or later
DSM 6.2.4-25556-8 or later

An administrator investigating an old NAS should therefore check both DSM and installed packages. Updating one does not automatically prove that everything else was updated at the same time.

What Should Synology Users Do Right Now?

Start with version verification. Open DSM and check the installed version of Synology Photos through Package Center. If the NAS is running one of the vulnerable release branches, verify that Photos is at or above Synology’s fixed version.

Then check DSM itself. Do not stop after seeing that the operating system says “up to date.” Verify package updates as well, particularly on systems that have been manually maintained or disconnected for extended periods. BeeStation owners should similarly confirm that both BeeStation OS and BeePhotos are current.

Internet-Facing Systems Deserve Immediate Attention

The vulnerability becomes particularly concerning when the affected service can be reached from outside the local network. Administrators should determine how the NAS is currently exposed.

Check for:

Router port-forwarding rules
Reverse-proxy entries
Public DNS records
Direct DSM exposure
Published Photos services
Old firewall rules
UPnP-created mappings
Remote-access configurations no longer needed

Do not assume a service is private simply because nobody remembers creating the rule. Infrastructure changes accumulate over time. An old port-forwarding rule created several years ago may still expose a service today.

Don’t Treat a Different Port Number as Protection

Moving DSM or another service away from its default port can reduce background scanning noise, but it does not patch a remotely exploitable vulnerability. An attacker can scan for services on nonstandard ports. Likewise, HTTPS protects traffic in transit but does not correct vulnerable application code.

The priority order should be:

Patch the vulnerability first.

Then reduce unnecessary exposure. Then strengthen authentication and network controls. Security configuration should complement patching, not substitute for it.

Synology Listed No Mitigation for CVE-2024-10443

This is one of the most important details in Synology’s advisory.

Under mitigation, Synology states:

None.

That means administrators should not rely on a configuration workaround as an equivalent substitute for installing the fixed package. Restricting external access can reduce exposure while investigating a system, but the vulnerable software should still be upgraded. For an actively exposed and vulnerable NAS, temporarily removing external access until the update is complete is a sensible defensive step.

What If the NAS Was Exposed While Vulnerable?

Updating closes the known vulnerability, but it does not answer another important question:

Was the system already compromised before it was patched?

If a vulnerable version was publicly reachable for a meaningful period, administrators should perform additional review rather than simply installing the update and walking away.

Look for unexpected changes such as:

Unknown administrator accounts
Unexpected packages
Unfamiliar scheduled tasks
Strange startup behavior
Unexpected outbound connections
Unexplained CPU or memory usage
New or modified firewall rules
Unusual authentication events
Unexpected files or scripts
Configuration changes nobody recognizes

Also review available DSM logs and security notifications.

The absence of an obvious warning does not conclusively prove that no compromise occurred, but unusual activity deserves investigation.

Run Security Advisor After Updating

Synology Security Advisor can help identify common DSM configuration and security problems. After patching, run a fresh scan and review its findings. This is particularly useful for older NAS installations where configuration has evolved over several years. The scan should not be treated as proof that a system was never compromised, but it can identify additional weaknesses that should be corrected while the NAS is already undergoing security review.

Rotate Credentials If Compromise Is Plausible

If there is credible reason to believe an exposed system may have been compromised, changing only the Photos package is not sufficient incident response.

Consider rotating:

DSM administrator credentials
User passwords
API credentials
Application passwords
SSH credentials
Backup credentials
Tokens
Credentials stored or accessible from the NAS

Also review accounts and permissions. An attacker who achieved code execution may have attempted to establish another method of access that survives after the original vulnerability is patched.

Check Your Backups Before Making Major Remediation Changes

A suspected compromise creates an uncomfortable problem: you may need to make substantial changes to the NAS while also preserving valuable data. Verify that critical information has an independent backup before performing major remediation.

Ideally, that backup should not exist solely on the potentially affected NAS. For business systems, this is another reason to maintain a 3-2-1 or stronger 3-2-1-1-0 backup architecture with an off-site, isolated, or immutable copy. A security incident should never leave the organization deciding between preserving evidence and preserving its only copy of business data. Business backups should include isolation, immutability, and recovery verification.

Snapshots Help, but They Don’t Patch Software

Btrfs snapshots and Snapshot Replication can be extremely useful for recovering files from accidental deletion, ransomware, or unwanted modifications. But snapshots do not eliminate the need to patch vulnerable applications.

Likewise:

RAID is not a security control.
Hyper Backup is not a patch.
Two-factor authentication does not fix unauthenticated RCE.
A firewall does not make vulnerable software safe if the service remains reachable by an attacker.

Each layer has a different purpose.

Strong Synology security comes from combining timely updates, restricted network exposure, authentication, permissions, snapshots, independent backups, and monitoring.

Review Package Updates as Seriously as DSM Updates

The Photos incident provides a useful lesson for Synology administrators. Many people think about NAS patching primarily in terms of DSM.

But a modern Synology may run numerous packages, including:

Synology Photos
Synology Drive Server
Surveillance Station
Active Backup applications
Hyper Backup
Container Manager
Media applications
Third-party packages

Those applications expand what the NAS can do, but they also expand its software attack surface.

Synology’s security advisory archive from the same Pwn2Own period includes separate advisories affecting DSM, Photos, BeePhotos, Synology Drive Server, Replication Service, BeeStation, Synology Cameras, and other components. Patch management therefore needs to cover the entire NAS software stack.

Use a Simple Exposure Checklist for Every Synology NAS

For a business managing multiple Synology systems, maintain a repeatable review process.

At minimum, confirm:

DSM is on a supported, patched release.
Synology packages are current.
Photos and other remotely accessible applications are reviewed separately.
Unnecessary port forwarding is removed.
UPnP is not creating unwanted exposure.
Administrator accounts are reviewed.
MFA is enabled where appropriate.
Firewall rules are intentional.
Remote access methods are documented.
Security Advisor is checked regularly.
Logs and alerts are monitored.
Critical data has independent backups.
Recovery procedures are tested.

This turns security updates from an occasional emergency into normal infrastructure maintenance.

The Pwn2Own Vulnerabilities Are Patched

The good news is that Synology lists the Photos and BeePhotos vulnerability as resolved. Synology released fixed versions for the affected software, and actively maintained systems should already be well beyond the vulnerable releases. But “Synology fixed it” and “every deployed NAS is patched” are not the same statement.

Older NAS systems can remain online for years. Some have package updates configured differently from DSM updates. Others may sit in branch offices, homes, labs, or remote sites where nobody regularly checks Package Center. That is why CVE-2024-10443 remains a useful reminder in 2026. If you manage a Synology environment, verify rather than assume.

Check Synology Photos. Check DSM. Check BeePhotos where applicable. Review public exposure. And if an internet-facing system spent time running a vulnerable version, treat the situation as more than a routine software update. The patch closes the vulnerability.

About Epis Technology

Epis Technology helps businesses maintain secure Synology infrastructure through DSM and package patch management, exposure assessments, firewall and remote-access reviews, Security Advisor configuration, MFA, account and permission audits, Synology security monitoring, immutable backups, Snapshot Replication, Hyper Backup, ActiveProtect, ransomware resilience, and disaster recovery. Synology consulting can help design practical isolation and recovery architectures. Epis Technology can also review older or internet-facing Synology systems to identify outdated packages, unnecessary public exposure, backup weaknesses, and other risks that may remain even after a specific vulnerability has been patched.