Loading story…
Synology has reversed its earlier decision to restrict the use of third-party hard drives and SSDs in its 2025 line of DiskStation Plus NAS units following significant backlash from users and the broader tech community. Initially, the company announced that only Synology-branded or Synology-certified drives would be supported in new models such as the DS225+, DS725+, DS425+, DS925+, DS1525+, and DS1825+. This policy change meant that users could not utilize popular and often more affordable drives from brands like Western Digital and Seagate, which had previously been widely used in Synology NAS systems. The restriction also disabled key features for non-Synology drives, including storage pool creation, health monitoring, deduplication, and firmware updates, effectively forcing customers to purchase Synology-branded hardware to access the full capabilities of their NAS devices. Synology justified the move by claiming it would improve performance, reliability, and support, but the community response was overwhelmingly negative, with many users expressing frustration and some considering alternative NAS brands. The controversy was further fueled by the revelation that Synology does not manufacture its own drives but instead rebrands hardware from established vendors and applies custom firmware as a form of digital rights management (DRM). This DRM limited the functionality of non-Synology drives, raising concerns about vendor lock-in and reduced consumer choice. In response to the backlash, Synology announced that with the release of DiskStation Manager (DSM) 7.3, support for third-party drives would be reinstated for the affected NAS models. Users who upgrade to DSM 7.3 will regain the ability to install and create storage pools with third-party drives, restoring much of the lost functionality. However, the company has maintained restrictions for M.2 drives, which remain limited to Synology-branded options. Synology also stated it is working with drive manufacturers to expand the list of certified storage media, aiming to provide more reliable options for customers. The updated compatibility policy is now reflected on Synology’s website, where users can check which drives are supported. This policy reversal is seen as a win for consumer choice and flexibility, though some limitations persist. The incident has highlighted the importance of open hardware compatibility in the NAS market and has prompted increased scrutiny of vendor practices regarding digital rights management and product ecosystems. Rival NAS vendors have used the controversy to position their products as more open and user-friendly alternatives. The episode underscores the influence of user feedback and market competition in shaping vendor policies, especially in the rapidly evolving storage hardware sector. Synology’s decision to restore third-party drive support is expected to help the company retain its reputation for high-quality, flexible NAS solutions, though ongoing monitoring of its compatibility policies will be important for both consumers and industry observers.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Synology reversed the policy for 2025 NAS devices by re-enabling third-party HDD and SSD support through a DiskStation Manager 7.3 update, though reports indicated some limitations still remained.
Synology introduced a compatibility policy for its 2025 NAS units that restricted support for third-party HDDs and SSDs, drawing user backlash over the effective drive ban.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
zdnet.com
Open sourcetomshardware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Synology disclosed two **CVSS 9.8** vulnerabilities in DiskStation Manager (DSM), `CVE-2026-13639` and `CVE-2026-13684`, that allow network-based, unauthenticated attackers to read or write arbitrary files on affected NAS devices. The flaws—a weak login-session token generation issue and improper encoding/escaping in the SCGI component—can also enable file deletion and denial of service, creating a material risk of full NAS compromise and ransomware abuse. Affected DSM branches include 7.2.1, 7.2.2, 7.3, and 7.4. Synology issued fixes in DSM 7.4-90075, 7.3-86009-4, 7.2.2-72806-9, and 7.2.1-69057-12; no workaround is available. Administrators should apply the applicable update immediately and disconnect unpatchable systems or restrict exposure of their management interfaces. No public exploit or CISA KEV listing was reported at disclosure.
Sep 22, 2026
Synology addressed a critical remote code execution vulnerability (CVE-2025-12686) in its BeeStation product after the flaw was publicly demonstrated at the Pwn2Own Ireland 2025 competition. The vulnerability, which received a CVSS score of 9.8, stems from improper buffer size checks that allow remote attackers to execute arbitrary code on affected devices. Synology has released patches for all versions of BeeStation OS, urging users to upgrade to version 1.3.2-65648 or later to mitigate the risk. The flaw was one of several zero-days showcased at Pwn2Own Ireland 2025, where researchers were awarded over $1 million for discovering 73 unique vulnerabilities across a range of consumer and enterprise devices. The event highlighted the ongoing risks posed by zero-day vulnerabilities in widely used storage and smart home products. Other vendors, including QNAP, also issued patches for vulnerabilities revealed during the competition.
Jun 29, 2026
Synology disclosed **`CVE-2024-10441`**, a critical improper encoding or escaping of output flaw in the **system plugin daemon** affecting multiple products, including **BeeStation Manager**, **DiskStation Manager (DSM)**, and **Unified Controller/DSMUC**. The vulnerability can let a remote attacker execute arbitrary code **without user interaction**, and public advisories warned that successful exploitation could also enable unauthorized file access and modification, raising the risk of full device compromise and data exposure. Synology issued patched releases across affected **BeeStation OS**, **DSM**, and **DSMUC** branches, while national CERT guidance urged organizations to update exposed appliances immediately. Additional recommended mitigations included segmenting Synology devices from untrusted networks, restricting access with firewalls, monitoring for suspicious activity, and conducting regular vulnerability scans to identify unpatched systems.
Aug 1, 2026