Synology Mail Server Let Remote Attackers Tamper System Configurations

Last year, Taiwanese security firm QI-ANXIN Group’s Codesafe Team identified multiple vulnerabilities in Synology products, demonstrating the ongoing attention these systems receive from security researchers. The security flaw, tracked as CVE-2025-2848, affects multiple versions of the popular mail server software and has prompted Synology to release security patches for affected systems. Earlier this year, Synology also patched multiple vulnerabilities in its SRM (Synology Router Manager) software that allowed authenticated users to read or write non-sensitive files. While full technical details remain reserved until widespread patching has occurred, this type of vulnerability typically involves improper access control mechanisms that fail to properly restrict authenticated users from accessing or modifying configuration settings beyond their intended privileges. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Security researcher Chanin Kim discovered and reported the vulnerability to Synology as part of their responsible disclosure program. The security flaw specifically enables remote authenticated attackers to manipulate system configurations without requiring user interaction. This security issue emerges amid ongoing cybersecurity concerns for network-attached storage (NAS) devices and related services. As with all security updates, administrators should test the patched versions in non-production environments before deploying them to critical systems. In 2024, Synology addressed 13 security vulnerabilities across its product line. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 27 Mar 2025 11:45:21 +0000


Cyber News related to Synology Mail Server Let Remote Attackers Tamper System Configurations

Synology Mail Server Let Remote Attackers Tamper System Configurations - Last year, Taiwanese security firm QI-ANXIN Group’s Codesafe Team identified multiple vulnerabilities in Synology products, demonstrating the ongoing attention these systems receive from security researchers. The security flaw, tracked as ...
2 months ago Cybersecuritynews.com CVE-2025-2848
Critical Synology Vulnerability Let Attackers Remote Execute Arbitrary Code - CVE-2024-10445: An improper certificate validation vulnerability in the update functionality with a CVSS score of 4.3 that enables adjacent attackers to write limited files. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber ...
2 months ago Cybersecuritynews.com CVE-2024-10445
Configuring Email Security With DMARC, SPF, And DKIM - DMARC, or Domain-based Message Authentication, Reporting, and Conformance, ties SPF and DKIM results together and allows domain owners to specify how receiving mail servers should handle unauthenticated messages. SPF, or Sender Policy Framework, is a ...
4 weeks ago Cybersecuritynews.com
How to Extract Malware Configurations in a Sandbox - The most sought-after source of these indicators is malware configurations. Malware Sandboxing Leader ANY.RUN handles the heavy lifting of phishing and malware analysis for SOC and DFIR teams and also helps 300,000 professionals use the platform to ...
1 year ago Gbhackers.com
Royal Mail investigates data leak claims, no impact on operations - While Royal Mail and Spectos have yet to share more information on the breach, cybersecurity company Hudson Rock says the attackers gained access to Royal Mail systems using the credentials of a Spectos employee compromised in a 2021 info stealer ...
1 month ago Bleepingcomputer.com
CVE-2021-44549 - Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing ...
3 years ago
FireEye EDR Agent Vulnerability Let Attackers Inject Malicious Code - The newly identified vulnerability enables a malicious third party to invoke a persistent denial of service condition in the FireEye EDR agent by sending a specially crafted tamper protection event to the HX service, which triggers an exception in ...
1 month ago Cybersecuritynews.com CVE-2025-0618
Windows 11 to let admins mandate SMB encryption for outbound connections - Windows 11 will let admins mandate SMB client encryption for all outbound connections, starting with today's Windows 11 Insider Preview Build 25982 rolling out to Insiders in the Canary Channel. SMB encryption provides data end-to-end encryption and ...
1 year ago Bleepingcomputer.com
Group behind LockBit ransomware claims responsibility for cyberattack on Royal Mail - The LockBit ransomware group has been linked to a cyberattack on the UK's leading mail delivery service, Royal Mail, which has caused severe disruption to their international shipping services. LockBitSupport, the ransomware gang's public-facing ...
2 years ago Bleepingcomputer.com LockBit
CVE-2024-4692 - Medium OpenText Application Automation Tools Plugin 24.1.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate ALM jobs configurations, ALM Octane configurations ...
1 year ago Tenable.com
CVE-2024-4691 - Medium OpenText Application Automation Tools Plugin 24.1.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate ALM jobs configurations, ALM Octane configurations ...
1 year ago Tenable.com
CVE-2024-4211 - Medium OpenText Application Automation Tools Plugin 24.1.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate ALM jobs configurations, ALM Octane configurations ...
1 year ago Tenable.com
CVE-2024-35187 - Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, attackers who achieved Arbitrary Code Execution as the stalwart-mail user (including web interface admins) can gain complete root access to the system. Usually, system ...
1 year ago
CISA, FBI, EAC and USPIS Release Election Mail Handling Procedures to Protect Against Hazardous Materials - This resource helps officials understand safe mail handling procedures and provides guidance on responding to potential hazardous materials exposure. Over the past two decades, U.S. government offices and employees have been the target of multiple ...
1 year ago Cisa.gov
IDOR vulnerability in ExHub Let Attacker Modify Web Hosting Configuration - The consequences of this IDOR vulnerability were severe where attackers could manipulate deployment configurations, potentially gaining unauthorized access to sensitive resources. This vulnerability effectively allowed unauthorized users to perform ...
3 months ago Cybersecuritynews.com
CVE-2022-31098 - Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in the logging of Weave GitOps could allow an authenticated remote attacker to view sensitive ...
2 years ago
CVE-2024-2502 - An application can be configured to block boot attempts after consecutive tamper resets are detected, which may not occur as expected. ...
9 months ago
CVE-2022-31131 - Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user account ownership checks when performing tasks related to mail attachments. Attachments may have been exposed ...
1 year ago
Weekly Cyber Security News Letter - Last Week's Top Cyber Attacks & Vulnerabilities - A critical vulnerability in Windows Defender Application Control (WDAC) has been uncovered, allowing attackers to bypass strict security policies using WinDbg Preview, a Microsoft Store app. A vulnerability in the FireEye EDR agent allows attackers ...
1 month ago Cybersecuritynews.com Hunters Akira
46 New Vulnerabilities in Solar Inverters Systems Let Attackers Tamper Inverter Settings - Researchers have uncovered critical security flaws in global solar power infrastructure that could potentially allow malicious actors to seize control of solar inverters and manipulate power generation at scale. Research indicates over half of solar ...
2 months ago Cybersecuritynews.com
CVE-2023-25194 - A possible security vulnerability has been identified in Apache Kafka Connect API. ...
1 year ago
CVE-2023-25160 - Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11.8, an attacker can access the mail box by ID getting the subjects and the first characters of the emails. Users should upgrade to ...
2 years ago
CVE-2024-25618 - Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers (CAS, SAML, OIDC) to attach to existing local users with the same e-mail address. This results in a ...
1 year ago
CVE-2010-3887 - The Limit Mail feature in the Parental Controls functionality in Mail on Apple Mac OS X does not properly enforce the correspondence whitelist, which allows remote attackers to bypass intended access restrictions and conduct e-mail communication by ...
14 years ago
Election security threats in 2024 range from AI to anthrax The Register - In time for the long Presidents' Day weekend in the US there have been multiple warnings about what will undoubtedly be a challenging and potentially dangerous year for voting processes and government workers. State and county officials have been ...
1 year ago Go.theregister.com