In a published advisory, networking device manufacturer Synology stated that it patched a critical remote code execution (RCE) vulnerability affecting their VPN Plus Server solution for Synology Router Manager (SRM). The flaw, tracked as CVE-2022-43931, received the maximum severity with a CVSS score of 10/10. The vulnerability is described as an out-of-bounds write flaw specifically impacting the remote desktop functionality and could be exploited by threat actors to remotely execute arbitrary code and commands on the target system. VPN Plus is an add-on package that enables Synology NAS devices to become VPN servers, allowing Synology DiskStation Manager (DSM) users over the internet to securely access the resources shared in a Synology device’s network. Successful exploitation of this vulnerability could allow threat actors to completely take over a vulnerable system and carry out devastating follow-on attacks. A week prior to Synology’s RCE advisory, the company released a patch advisory for multiple other vulnerabilities (some were demonstrated at the December 2022 Pwn2Own contest) which could allow remote attackers to execute arbitrary commands, conduct denial-of-service (DoS) attacks or read arbitrary files after exploiting a vulnerable version of SRM. These are very low-complexity attacks which could be exploited by unsophisticated threat actors. To prevent exploitation of any of the vulnerabilities, CTIX analysts urge all SRM users to immediately update to the latest secure version of their device firmware. Specific details surrounding the updates can be found in the Synology advisories linked below.