Synology Security Advisory SA-25:12 on Resolved Vulnerability for BeeStation (PWN2OWN 2025)

Synology, Inc. had published a security advisory concerning a resolved vunerability in BeeStation OS.

Publish Time: 2025-11-10 15:20:37 UTC+8
Last Updated: 2025-11-10 15:20:51 UTC+8
Severity: Critical
Status: Resolved

Abstract
The company has released a security update for the BeeStation OS to address ZDI-CAN-28275 :

• CVE-2025-12686 allows remote attackers to execute arbitrary code.

Refer to the ‘Affected Products’ table for the corresponding updates.

Affected Products

Mitigation: None

Detail:

• CVE-2025-12686

  • Severity: Critical

  • CVSS3 Base Score: 9.8

  • CVSS3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)

  • ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Acknowledgement: @Tek_7987 and @_Anyfun (@Synacktiv)

Reference: CVE-2025-12686

Revision: