Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

NAS

Security incidents tagged NAS. Newest first.

2 NAS incidents in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½LessMore
Incidents
3
Live
2
Patched
2
Days without an incident
3
Longest quiet run: 889 days (Apr 12–Sep 17)
All tags →

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

  • LivePatched

    TrueNAS SCALE: HA heartbeat check grants root-level admin API access to a nearby attacker (CVE-2026-123033)

    TrueNAS says its middleware (middlewared) in TrueNAS SCALE, Community Edition and Enterprise, trusted any API connection whose source address was one of the hardcoded HA heartbeat addresses (169.254.10.1 or 169.254.10.2) and whose source port was 1024 or lower, and handed it an internal node credential that counts as full administrator for every API method. The hook is registered on every install, including single-node Community Edition systems with no HA set up. Admin API access can be used to run commands as root, bypasses the management IP allowlist and rate limiting, and is not recorded in the audit log. It cannot be exploited from the internet: the attacker has to be on the same layer-2 segment as the management interface (for example a VM on the same hypervisor switch or a host on a flat VLAN) and also has to control the return path, since TrueNAS has no route to 169.254.0.0/16. TrueNAS rates it CVSS 3.1 8.3 (high). The fix shipped in TrueNAS SCALE 25.10.8 (Goldeye), released Nov 5 2026; upgrade to 25.10.8 or later. Until upgraded, keep the management interface on a dedicated, trusted network. TrueNAS CORE is not affected. No exploitation has been reported.

    TrueNAS SCALE (Community Edition and Enterprise)Since Nov 5, 2026

Show 2 older incidents

October 2026 1

  • LivePatched

    C3RB3R (Cerber) ransomware hits Synology NAS devices through DSM flaws CVE-2026-13639 and CVE-2026-13684

    Since October 2026, 360's anti-ransomware team has handled multiple ransomware attacks on Synology NAS devices by C3RB3R, a variant of the Cerber ransomware family. 360 says the attackers get in through CVE-2026-13639 (insufficient entropy in DSM login logic) and CVE-2026-13684 (improper output encoding in DSM's SCGI), two critical, unauthenticated remote bugs that Synology fixed on Sep 18 2026 in advisory Synology-SA-26:13. Encrypted files get the .L0CK3D extension and a read-me3.txt ransom note is dropped in each folder. Devices that haven't installed the September DSM update are at risk.

    Synology DiskStation Manager (DSM)Since Oct 1, 2026

April 2024 1

  • CriticalD-Link Multiple NAS Devices: 2 actively exploited vulnerabilities

    D-Link Multiple NAS Devices No patch yet

    CVE-2024-3272: D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution. CVE-2024-3273: D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution. Added to the CISA KEV catalog on 2024-04-11.

    Open incident →CVE-2024-3272 · CVE-2024-3273

Sponsored

Buy sponsor slot · $149/mo