飛牛 NAS fnOS 資訊安全通告，請更新至 1.1.18 版本

說明

飛牛安全團隊近日針對fnOS發布緊急通告，要求逾19萬名用戶盡速升級1.1.18版本以對抗新型木馬變種。與過去最大的差異在於，官方此次不僅要修補存在超過506天、讓隱私文件「裸奔」的路徑穿越漏洞，更要應對黑客針對OTA升級機制發動的對抗性攻擊。
系統長期存在的root權限漏洞，攻擊者隨即採取高度組織化的行動破壞更新服務，導致部分設備無法接收補丁。在官方推出修補程式後，黑客甚至對官網發動DDOS攻擊企圖阻斷救援，位於廣州的開發團隊提醒，若不採取重裝系統或執行緊急腳本等建議措施，受感染設備將面臨被持續控制並成為僵屍網絡節點的重大風險。

連結

[【緊急】重要安全更新通知 - 新手入門飛牛私有雲論壇 fnOS](https://club.fnnas.com/forum.php?mod=viewthread&tid=53420)
[【緊急安全通告】木馬變種對抗與裝置修復指南 - 新手入門飛牛私有雲論壇 fnOS](https://club.fnnas.com/forum.php?mod=viewthread&tid=53831)
[知名NAS系统让用户文件裸奔！逆向深入分析，安全形同虚设！| 飞牛 | 路径穿越 | BUG | 漏洞 | 信息安全 | 边亮 - YouTube](https://www.youtube.com/watch?v=0X-xPYF_Wig)

About the author

喜愛用文字說明自己眼中所見的一切

張貼留言

張貼留言

<script type="text/javascript" src="https://www.blogger.com/static/v1/widgets/2028843038-widgets.js"></script>
<script type='text/javascript'>
window['__wavt'] = 'AOuZoY76fcIv8d6URuDl4CcOUfxqHNNUjA:1770503134027';_WidgetManager._Init('//www.blogger.com/rearrange?blogID\x3d19530189','//www.ckizumi.com/2026/02/nas-fnos-1118.html','19530189');
_WidgetManager._SetDataContext([{'name': 'blog', 'data': {'blogId': '19530189', 'title': '\u7cca\u5857\u5c0f\u6cc9\u6307\u5357', 'url': 'https://www.ckizumi.com/2026/02/nas-fnos-1118.html', 'canonicalUrl': 'https://www.ckizumi.com/2026/02/nas-fnos-1118.html', 'homepageUrl': 'https://www.ckizumi.com/', 'searchUrl': 'https://www.ckizumi.com/search', 'canonicalHomepageUrl': 'https://www.ckizumi.com/', 'blogspotFaviconUrl': 'https://www.ckizumi.com/favicon.ico', 'bloggerUrl': 'https://www.blogger.com', 'hasCustomDomain': true, 'httpsEnabled': true, 'enabledCommentProfileImages': true, 'gPlusViewType': 'FILTERED_POSTMOD', 'adultContent': false, 'analyticsAccountNumber': 'UA-3305637-9', 'encoding': 'UTF-8', 'locale': 'zh-TW', 'localeUnderscoreDelimited': 'zh_tw', 'languageDirection': 'ltr', 'isPrivate': false, 'isMobile': false, 'isMobileRequest': false, 'mobileClass': '', 'isPrivateBlog': false, 'isDynamicViewsAvailable': true, 'feedLinks': '\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22\u7cca\u5857\u5c0f\u6cc9\u6307\u5357 - Atom\x22 href\x3d\x22https://www.ckizumi.com/feeds/posts/default\x22 /\x3e\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/rss+xml\x22 title\x3d\x22\u7cca\u5857\u5c0f\u6cc9\u6307\u5357 - RSS\x22 href\x3d\x22https://www.ckizumi.com/feeds/posts/default?alt\x3drss\x22 /\x3e\n\x3clink rel\x3d\x22service.post\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22\u7cca\u5857\u5c0f\u6cc9\u6307\u5357 - Atom\x22 href\x3d\x22https://www.blogger.com/feeds/19530189/posts/default\x22 /\x3e\n\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22\u7cca\u5857\u5c0f\u6cc9\u6307\u5357 - Atom\x22 href\x3d\x22https://www.ckizumi.com/feeds/2472535992561660483/comments/default\x22 /\x3e\n', 'meTag': '', 'adsenseHostId': 'ca-host-pub-1556223355139109', 'adsenseHasAds': false, 'adsenseAutoAds': false, 'boqCommentIframeForm': true, 'loginRedirectParam': '', 'view': '', 'dynamicViewsCommentsSrc': '//www.blogblog.com/dynamicviews/4224c15c4e7c9321/js/comments.js', 'dynamicViewsScriptSrc': '//www.blogblog.com/dynamicviews/dec693955754c531', 'plusOneApiSrc': 'https://apis.google.com/js/platform.js', 'disableGComments': true, 'interstitialAccepted': false, 'sharing': {'platforms': [{'name': '\u53d6\u5f97\u9023\u7d50', 'key': 'link', 'shareMessage': '\u53d6\u5f97\u9023\u7d50', 'target': ''}, {'name': 'Facebook', 'key': 'facebook', 'shareMessage': '\u5206\u4eab\u5230 Facebook', 'target': 'facebook'}, {'name': 'BlogThis\uff01', 'key': 'blogThis', 'shareMessage': 'BlogThis\uff01', 'target': 'blog'}, {'name': 'X', 'key': 'twitter', 'shareMessage': '\u5206\u4eab\u5230 X', 'target': 'twitter'}, {'name': 'Pinterest', 'key': 'pinterest', 'shareMessage': '\u5206\u4eab\u5230 Pinterest', 'target': 'pinterest'}, {'name': '\u4ee5\u96fb\u5b50\u90f5\u4ef6\u50b3\u9001', 'key': 'email', 'shareMessage': '\u4ee5\u96fb\u5b50\u90f5\u4ef6\u50b3\u9001', 'target': 'email'}], 'disableGooglePlus': true, 'googlePlusShareButtonWidth': 0, 'googlePlusBootstrap': '\x3cscript type\x3d\x22text/javascript\x22\x3ewindow.___gcfg \x3d {\x27lang\x27: \x27zh_TW\x27};\x3c/script\x3e'}, 'hasCustomJumpLinkMessage': true, 'jumpLinkMessage': '\u7e7c\u7e8c\u95b1\u8b80 \xbb', 'pageType': 'item', 'postId': '2472535992561660483', 'postImageThumbnailUrl': 'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbQvbkmeyJIOrhV25kHu3qigXIpQ8uyb3Zlgas9ZaHiMdoMuI2TEGV-9zVDPyfMevbWob6tDua2hYI93EH3b516QnyKYro8J9MYvBwEThyphenhyphenp7iYjJJoIU4qgjurUF_6q4MF-xU7wgqLgk8iYjKCMab3-JCKk40P4CzyNK1Qi2325Uu5WQEyJfWTbg/s72-w640-c-h358/1770481403985.png', 'postImageUrl': 'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbQvbkmeyJIOrhV25kHu3qigXIpQ8uyb3Zlgas9ZaHiMdoMuI2TEGV-9zVDPyfMevbWob6tDua2hYI93EH3b516QnyKYro8J9MYvBwEThyphenhyphenp7iYjJJoIU4qgjurUF_6q4MF-xU7wgqLgk8iYjKCMab3-JCKk40P4CzyNK1Qi2325Uu5WQEyJfWTbg/w640-h358/1770481403985.png', 'pageName': '\u98db\u725b NAS fnOS \u8cc7\u8a0a\u5b89\u5168\u901a\u544a\uff0c\u8acb\u66f4\u65b0\u81f3 1.1.18 \u7248\u672c', 'pageTitle': '\u7cca\u5857\u5c0f\u6cc9\u6307\u5357: \u98db\u725b NAS fnOS \u8cc7\u8a0a\u5b89\u5168\u901a\u544a\uff0c\u8acb\u66f4\u65b0\u81f3 1.1.18 \u7248\u672c'}}, {'name': 'features', 'data': {}}, {'name': 'messages', 'data': {'edit': '\u7de8\u8f2f', 'linkCopiedToClipboard': '\u5df2\u5c07\u9023\u7d50\u8907\u88fd\u5230\u526a\u8cbc\u7c3f\uff01', 'ok': '\u78ba\u5b9a', 'postLink': '\u6587\u7ae0\u9023\u7d50'}}, {'name': 'template', 'data': {'name': 'custom', 'localizedName': '\u81ea\u8a02', 'isResponsive': true, 'isAlternateRendering': false, 'isCustom': true}}, {'name': 'view', 'data': {'classic': {'name': 'classic', 'url': '?view\x3dclassic'}, 'flipcard': {'name': 'flipcard', 'url': '?view\x3dflipcard'}, 'magazine': {'name': 'magazine', 'url': '?view\x3dmagazine'}, 'mosaic': {'name': 'mosaic', 'url': '?view\x3dmosaic'}, 'sidebar': {'name': 'sidebar', 'url': '?view\x3dsidebar'}, 'snapshot': {'name': 'snapshot', 'url': '?view\x3dsnapshot'}, 'timeslide': {'name': 'timeslide', 'url': '?view\x3dtimeslide'}, 'isMobile': false, 'title': '\u98db\u725b NAS fnOS \u8cc7\u8a0a\u5b89\u5168\u901a\u544a\uff0c\u8acb\u66f4\u65b0\u81f3 1.1.18 \u7248\u672c', 'description': '\u8aaa\u660e \u98db\u725b\u5b89\u5168\u5718\u968a\u8fd1\u65e5\u91dd\u5c0dfnOS\u767c\u5e03\u7dca\u6025\u901a\u544a\uff0c\u8981\u6c42\u903e19\u842c\u540d\u7528\u6236\u76e1\u901f\u5347\u7d1a1.1.18\u7248\u672c\u4ee5\u5c0d\u6297\u65b0\u578b\u6728\u99ac\u8b8a\u7a2e\u3002\u8207\u904e\u53bb\u6700\u5927\u7684\u5dee\u7570\u5728\u65bc\uff0c\u5b98\u65b9\u6b64\u6b21\u4e0d\u50c5\u8981\u4fee\u88dc\u5b58\u5728\u8d85\u904e506\u5929\u3001\u8b93\u96b1\u79c1\u6587\u4ef6\u300c\u88f8\u5954\u300d\u7684\u8def\u5f91\u7a7f\u8d8a\u6f0f\u6d1e\uff0c\u66f4\u8981\u61c9\u5c0d\u9ed1\u5ba2\u91dd\u5c0dOTA\u5347\u7d1a\u6a5f\u5236\u767c\u52d5\u7684\u5c0d\u6297\u6027\u653b\u64ca\u3002 \u7cfb\u7d71\u9577\u671f\u5b58\u5728\u7684root\u6b0a\u9650\u6f0f...', 'featuredImage': 'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbQvbkmeyJIOrhV25kHu3qigXIpQ8uyb3Zlgas9ZaHiMdoMuI2TEGV-9zVDPyfMevbWob6tDua2hYI93EH3b516QnyKYro8J9MYvBwEThyphenhyphenp7iYjJJoIU4qgjurUF_6q4MF-xU7wgqLgk8iYjKCMab3-JCKk40P4CzyNK1Qi2325Uu5WQEyJfWTbg/w640-h358/1770481403985.png', 'url': 'https://www.ckizumi.com/2026/02/nas-fnos-1118.html', 'type': 'item', 'isSingleItem': true, 'isMultipleItems': false, 'isError': false, 'isPage': false, 'isPost': true, 'isHomepage': false, 'isArchive': false, 'isLabelSearch': false, 'postId': 2472535992561660483}}, {'name': 'widgets', 'data': [{'title': '\u7cca\u5857\u5c0f\u6cc9\u6307\u5357 (\u6a19\u982d)', 'type': 'Header', 'sectionId': 'sec_Header_Title', 'id': 'Header01'}, {'title': '\u4eca\u5929\u60f3\u627e\u4e9b\u4ec0\u9ebc\u5462?', 'type': 'BlogSearch', 'sectionId': 'sec_Header_Search', 'id': 'BlogSearch01'}, {'title': 'Header Icon', 'type': 'TextList', 'sectionId': 'sec_Header_Icon', 'id': 'TextList01'}, {'title': 'Bookmark Posts', 'type': 'LinkList', 'sectionId': 'sec_Header_Icon', 'id': 'LinkList02'}, {'title': 'Navigation Menu (Simple)', 'type': 'PageList', 'sectionId': 'sec_Nav_Widgets_1', 'id': 'PageList01'}, {'title': 'Pinned Post', 'type': 'FeaturedPost', 'sectionId': 'sec_Top_Widgets', 'id': 'FeaturedPost01', 'postId': '5159863938720714151'}, {'title': '\u7db2\u8a8c\u6587\u7ae0', 'type': 'Blog', 'sectionId': 'sec_Main_Widgets', 'id': 'Blog01', 'posts': [{'id': '2472535992561660483', 'title': '\u98db\u725b NAS fnOS \u8cc7\u8a0a\u5b89\u5168\u901a\u544a\uff0c\u8acb\u66f4\u65b0\u81f3 1.1.18 \u7248\u672c', 'featuredImage': 'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbQvbkmeyJIOrhV25kHu3qigXIpQ8uyb3Zlgas9ZaHiMdoMuI2TEGV-9zVDPyfMevbWob6tDua2hYI93EH3b516QnyKYro8J9MYvBwEThyphenhyphenp7iYjJJoIU4qgjurUF_6q4MF-xU7wgqLgk8iYjKCMab3-JCKk40P4CzyNK1Qi2325Uu5WQEyJfWTbg/w640-h358/1770481403985.png', 'showInlineAds': false}], 'headerByline': {'regionName': 'header1', 'items': [{'name': 'timestamp', 'label': 'On'}]}, 'footerBylines': [{'regionName': 'footer1', 'items': [{'name': 'comments', 'label': 'Comment'}, {'name': 'icons', 'label': ''}]}, {'regionName': 'footer2', 'items': [{'name': 'labels', 'label': 'in'}]}, {'regionName': 'footer3', 'items': [{'name': 'location', 'label': 'Location:'}]}], 'allBylineItems': [{'name': 'timestamp', 'label': 'On'}, {'name': 'comments', 'label': 'Comment'}, {'name': 'icons', 'label': ''}, {'name': 'labels', 'label': 'in'}, {'name': 'location', 'label': 'Location:'}]}, {'title': 'Table of contents', 'type': 'HTML', 'sectionId': 'sec_Main_Widgets', 'id': 'HTML11'}, {'title': 'Popular Posts', 'type': 'PopularPosts', 'sectionId': 'sec_Side_Widgets', 'id': 'PopularPosts01', 'posts': [{'title': 'Notepad++\u906d\u570b\u5bb6\u99ed\u5ba2\u52ab\u6301\u534a\u5e74\uff0c\u5b98\u7db2\u7c72\u624b\u52d5\u66f4\u65b0v8.9.1', 'id': 4430969161810852052}, {'title': '\u96a8\u624b\u5beb February 2, 2026 \u8acb\u52ff\u6500\u722c', 'id': 9171170360877446171}, {'title': '\u5410\u5410\u6e05\u7406\u7684\u500b\u4eba\u5efa\u8b70', 'id': 8805543778487892557}]}, {'title': 'Labels', 'type': 'Label', 'sectionId': 'sec_Side_Widgets', 'id': 'Label01'}, {'title': 'Take me back', 'type': 'HTML', 'sectionId': 'sec_Error_404', 'id': 'HTML404'}, {'title': 'Organization [BlogTitle]', 'type': 'Image', 'sectionId': 'sec_Footer_Organization', 'id': 'Image21'}, {'title': 'Social Media Links', 'type': 'LinkList', 'sectionId': 'sec_Footer_Organization', 'id': 'LinkList21'}, {'title': 'Credit', 'type': 'HTML', 'sectionId': 'sec_Footer_Bottom', 'id': 'HTML21'}, {'title': 'Mobile Menu', 'type': 'TextList', 'sectionId': 'sec_Mobile_Menu', 'id': 'TextList99'}, {'title': 'Labels', 'type': 'Label', 'sectionId': 'sec_Theme_Hidden', 'id': 'Label41'}, {'title': '\u806f\u7d61\u8868\u55ae', 'type': 'ContactForm', 'sectionId': 'sec_Theme_Hidden', 'id': 'ContactForm41'}, {'title': 'Pageviews last month', 'type': 'Stats', 'sectionId': 'sec_Theme_Hidden', 'id': 'Stats41'}, {'title': 'Firebase Configurations', 'type': 'LinkList', 'sectionId': 'sec_Addon_Widgets', 'id': 'LinkList61'}]}]);
_WidgetManager._RegisterWidget('_HeaderView', new _WidgetInfo('Header01', 'sec_Header_Title', document.getElementById('Header01'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_BlogSearchView', new _WidgetInfo('BlogSearch01', 'sec_Header_Search', document.getElementById('BlogSearch01'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_TextListView', new _WidgetInfo('TextList01', 'sec_Header_Icon', document.getElementById('TextList01'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList02', 'sec_Header_Icon', document.getElementById('LinkList02'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_PageListView', new _WidgetInfo('PageList01', 'sec_Nav_Widgets_1', document.getElementById('PageList01'), {'title': 'Navigation Menu (Simple)', 'links': [{'isCurrentPage': false, 'href': 'https://www.ckizumi.com/', 'id': '0', 'title': '\u56de\u5230\u9996\u9801'}, {'isCurrentPage': false, 'href': 'https://www.ckizumi.com/search/label/%40%E9%9A%BB%E8%A8%80%E7%89%87%E8%AA%9E', 'title': '[\u5c08\u6b04] \u96bb\u5b57\u7247\u8a9e'}, {'isCurrentPage': false, 'href': 'https://www.ckizumi.com/search/label/%40%E7%BE%8E%E5%91%B3%E6%9B%B8%E7%B1%A4', 'title': '[\u5c08\u6b04] \u7f8e\u5473\u66f8\u7c64'}, {'isCurrentPage': false, 'href': 'https://www.ckizumi.com/search/label/%40%E9%9B%BB%E8%85%A6%E7%9B%92%E5%AD%90', 'title': '[\u5c08\u6b04] \u96fb\u8166\u76d2\u5b50'}, {'isCurrentPage': false, 'href': 'https://www.ckizumi.com/search/label/%23%E8%A1%A8%E6%BC%94%F0%9F%8E%AD', 'title': '#\u8868\u6f14\ud83c\udfad'}, {'isCurrentPage': false, 'href': 'https://www.ckizumi.com/search/label/%40%E7%99%BC%E5%B1%95%E8%A9%B1%E9%A1%8C', 'title': '[\u8ffd\u8e64] \u767c\u5c55\u8a71\u984c'}], 'mobile': false, 'showPlaceholder': true, 'hasCurrentPage': false}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_FeaturedPostView', new _WidgetInfo('FeaturedPost01', 'sec_Top_Widgets', document.getElementById('FeaturedPost01'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_BlogView', new _WidgetInfo('Blog01', 'sec_Main_Widgets', document.getElementById('Blog01'), {'cmtInteractionsEnabled': false, 'lightboxEnabled': true, 'lightboxModuleUrl': 'https://www.blogger.com/static/v1/jsbin/1764048512-lbx__zh_tw.js', 'lightboxCssUrl': 'https://www.blogger.com/static/v1/v-css/828616780-lightbox_bundle.css'}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML11', 'sec_Main_Widgets', document.getElementById('HTML11'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_PopularPostsView', new _WidgetInfo('PopularPosts01', 'sec_Side_Widgets', document.getElementById('PopularPosts01'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LabelView', new _WidgetInfo('Label01', 'sec_Side_Widgets', document.getElementById('Label01'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML404', 'sec_Error_404', document.getElementById('HTML404'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_ImageView', new _WidgetInfo('Image21', 'sec_Footer_Organization', document.getElementById('Image21'), {'resize': true}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList21', 'sec_Footer_Organization', document.getElementById('LinkList21'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML21', 'sec_Footer_Bottom', document.getElementById('HTML21'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_TextListView', new _WidgetInfo('TextList99', 'sec_Mobile_Menu', document.getElementById('TextList99'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LabelView', new _WidgetInfo('Label41', 'sec_Theme_Hidden', document.getElementById('Label41'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_ContactFormView', new _WidgetInfo('ContactForm41', 'sec_Theme_Hidden', document.getElementById('ContactForm41'), {'contactFormMessageSendingMsg': '\u50b3\u9001\u4e2d...', 'contactFormMessageSentMsg': '\u60a8\u7684\u90f5\u4ef6\u5df2\u5bc4\u51fa\u3002', 'contactFormMessageNotSentMsg': '\u7121\u6cd5\u50b3\u9001\u90f5\u4ef6\uff0c\u8acb\u7a0d\u5f8c\u518d\u8a66\u3002', 'contactFormInvalidEmailMsg': '\u8acb\u8f38\u5165\u6709\u6548\u7684\u96fb\u5b50\u90f5\u4ef6\u5730\u5740\u3002', 'contactFormEmptyMessageMsg': '\u90f5\u4ef6\u6b04\u4f4d\u4e0d\u53ef\u7a7a\u767d\u3002', 'title': '\u806f\u7d61\u8868\u55ae', 'blogId': '19530189', 'contactFormNameMsg': '\u540d\u7a31', 'contactFormEmailMsg': '\u4ee5\u96fb\u5b50\u90f5\u4ef6\u50b3\u9001', 'contactFormMessageMsg': '\u8a0a\u606f', 'contactFormSendMsg': '\u50b3\u9001', 'contactFormToken': 'AOuZoY6auHuX4pHv3VapsEXLpmukofsNlQ:1770503134027', 'submitUrl': 'https://www.blogger.com/contact-form.do'}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_StatsView', new _WidgetInfo('Stats41', 'sec_Theme_Hidden', document.getElementById('Stats41'), {'title': 'Pageviews last month', 'showGraphicalCounter': false, 'showAnimatedCounter': false, 'showSparkline': true, 'statsUrl': '//www.ckizumi.com/b/stats?style\x3dBLACK_TRANSPARENT\x26timeRange\x3dLAST_WEEK\x26token\x3dAPq4FmBhd_pUxHSglOMkr9xZpBZARlbodPYUZKVkyJvmRQ7EOYOjzcEG59R-YAIhWf6AZpJVgBAugdxgTN09IwBas8BFlvGYeQ'}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList61', 'sec_Addon_Widgets', document.getElementById('LinkList61'), {}, 'displayModeFull'));
</script>
</body>