Synology patches critical BeeStation RCE flaw shown at Pwn2Own Ireland 2025

Synology has patched a critical remote code execution flaw in BeeStation, tracked as CVE-2025-12686, which was demonstrated at Pwn2Own Ireland 2025. The vulnerability stems from unchecked buffer input that enables arbitrary code execution, and its CVSS score is listed as 9.8; the advisory notes that CVE-2025-12686 allows remote attackers to execute arbitrary code. The fix affects BeeStation OS versions 1.0 through 1.3 and requires upgrading to BeeStation OS 1.3.2-65648 or above.

Pwn2Own Ireland 2025 wrapped up with a prize of $1,024,750 across eight categories, and BeeStation’s RCE flaw was among the disclosed issues during the competition. According to the article, the patch was released after the event, and the QNAP team also patched zero-day vulnerabilities exploited at Pwn2Own Ireland 2025, illustrating the high stakes of the demonstrations.