CVE-2025-12686

Published May 27, 2026

Last updated 11 days ago

Synology BeeStation

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-12686 is a critical remote code execution (RCE) vulnerability found in Synology BeeStation devices. It was demonstrated at the Pwn2Own Ireland 2025 hacking competition. The vulnerability stems from an unchecked buffer input, which allows for arbitrary code execution. Successful exploitation of CVE-2025-12686 could allow an attacker to bypass the firewall and access personally identifiable information (PII) and trade secrets. Furthermore, the attacker could use the NAS's trusted internal IP address to move laterally toward the Domain Controller (DC) or virtual desktop infrastructure (VDI). Synology has released a patch to address this vulnerability.

Description: Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors.
Source: security@synology.com
NVD status: Analyzed
Products: beestation_os

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@synology.com: CWE-120

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:synology:beestation_os:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "CB4968D5-623C-4FD5-9930-7B4DEFFA9BC6",
            "versionEndExcluding": "1.3.2",
            "versionStartIncluding": "1.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.