For anyone with a Synology NAS...
"the part of the photo application that contains the zero-click vulnerability does not require authentication, so attackers can exploit the vulnerability directly over the internet without needing to bypass a gateway."
https://www.wired.com/story/synology-zero-click-vulnerability/