Pwn2Own Ireland 2025 Day Two: Multiple Zero-Day Exploits Demonstrated Across Consumer Devices

Security researchers at Pwn2Own Ireland 2025 demonstrated 56 unique zero-day vulnerabilities across a range of consumer devices on the second day of the competition, earning a total of $792,750 in rewards. Notable exploits included a major Samsung Galaxy S25 compromise by The Summoning Team and Mobile Hacking Lab, who chained five vulnerabilities to achieve their result, as well as successful attacks against QNAP TS-453E, Synology DS925+, Canon imageCLASS MF654Cdw printer, Home Automation Green, and Phillips Hue Bridge. The event featured participation from leading teams and individuals, with The Summoning Team leading the scoreboard after their Samsung Galaxy exploit, and other teams such as CyCraft, Verichains, and Qrious Secure also earning significant rewards for their discoveries.

The competition, sponsored by Meta, Synology, and QNAP, covered eight categories including flagship smartphones, printers, network storage, home networking gear, messaging apps, smart home and surveillance devices, and wearables. Vendors now have 90 days to address the vulnerabilities before public disclosure. Some exploits, such as the Synology BeeStation Plus, were ruled out of scope for the competition. The event highlights the ongoing risks posed by zero-day vulnerabilities in widely used consumer and enterprise devices, emphasizing the importance of coordinated vulnerability disclosure and rapid patching by vendors.