Loading story…
Synology addressed a critical remote code execution vulnerability (CVE-2025-12686) in its BeeStation product after the flaw was publicly demonstrated at the Pwn2Own Ireland 2025 competition. The vulnerability, which received a CVSS score of 9.8, stems from improper buffer size checks that allow remote attackers to execute arbitrary code on affected devices. Synology has released patches for all versions of BeeStation OS, urging users to upgrade to version 1.3.2-65648 or later to mitigate the risk.
The flaw was one of several zero-days showcased at Pwn2Own Ireland 2025, where researchers were awarded over $1 million for discovering 73 unique vulnerabilities across a range of consumer and enterprise devices. The event highlighted the ongoing risks posed by zero-day vulnerabilities in widely used storage and smart home products. Other vendors, including QNAP, also issued patches for vulnerabilities revealed during the competition.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Synology released a patch for the critical BeeStation remote code execution flaw CVE-2025-12686 after it was shown at Pwn2Own Ireland 2025. The patching action was reported the following day.
A critical remote code execution vulnerability in Synology BeeStation, later tracked as CVE-2025-12686, was demonstrated at the Pwn2Own Ireland 2025 contest. The supplied reporting identifies it as a zero-day affecting the product.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers at Pwn2Own Ireland 2025 demonstrated 56 unique zero-day vulnerabilities across a range of consumer devices on the second day of the competition, earning a total of $792,750 in rewards. Notable exploits included a major Samsung Galaxy S25 compromise by The Summoning Team and Mobile Hacking Lab, who chained five vulnerabilities to achieve their result, as well as successful attacks against QNAP TS-453E, Synology DS925+, Canon imageCLASS MF654Cdw printer, Home Automation Green, and Phillips Hue Bridge. The event featured participation from leading teams and individuals, with The Summoning Team leading the scoreboard after their Samsung Galaxy exploit, and other teams such as CyCraft, Verichains, and Qrious Secure also earning significant rewards for their discoveries. The competition, sponsored by Meta, Synology, and QNAP, covered eight categories including flagship smartphones, printers, network storage, home networking gear, messaging apps, smart home and surveillance devices, and wearables. Vendors now have 90 days to address the vulnerabilities before public disclosure. Some exploits, such as the Synology BeeStation Plus, were ruled out of scope for the competition. The event highlights the ongoing risks posed by zero-day vulnerabilities in widely used consumer and enterprise devices, emphasizing the importance of coordinated vulnerability disclosure and rapid patching by vendors.
Jun 29, 2026
Synology disclosed three vulnerabilities in **MailPlus Server** for DiskStation Manager (**DSM**), including two **Critical** flaws that can let attackers read or write arbitrary files and trigger denial-of-service conditions. The most severe issue, `CVE-2026-13136`, carries a **CVSS 10.0** rating and can be exploited remotely without authentication, while `CVE-2025-15660` can be abused by an adjacent attacker for similar file access and service disruption. A third flaw, `CVE-2026-13135`, is rated Moderate and can allow remote attackers to access internal services. The advisory affects MailPlus Server deployments on **DSM 7.3, 7.2.2, and 7.2.1**. Synology said there is **no mitigation or workaround** other than upgrading to the fixed releases, directing customers to update to **4.0.1-31663** or **4.0.1-21663** depending on platform version. Organizations using Synology MailPlus Server are being urged to patch immediately because the exposed attack paths include unauthenticated remote exploitation and arbitrary file operations.
Jul 12, 2026
QNAP has released security updates to address seven zero-day vulnerabilities in its network-attached storage (NAS) products after these flaws were exploited by security researchers during the Pwn2Own Ireland 2025 competition. The vulnerabilities affected QNAP's QTS and QuTS hero operating systems, as well as key applications including Hyper Data Protector, Malware Remover, and HBS 3 Hybrid Backup Sync. The exploits were demonstrated by teams such as Summoning Team, DEVCORE, Team DDOS, and a CyCraft technology intern, highlighting the critical nature of these security issues. QNAP has provided patched versions for all affected software and strongly recommends that users update to the latest releases and change all passwords to enhance security. The company has published detailed advisories and instructions for updating both the operating systems and vulnerable applications through the QTS or QuTS hero interface. Regular updates and monitoring of product support status are advised to ensure ongoing protection against similar vulnerabilities.
Jun 29, 2026