Critical Synology BeeStation Zero-Day (CVE-2025-12686) Found at Pwn2Own Allows Remote Code Execution

Synology has released an urgent security update for BeeStation OS to patch a zero-day vulnerability, CVE-2025-12686, that was demonstrated during the Pwn2Own Ireland 2025 hacking competition. The flaw is rated CVSS 9.8 (Critical) and enables remote attackers to execute arbitrary code on affected devices, potentially giving them full control. According to Synology’s advisory, BeeStation OS versions 1.0 through 1.3 are affected, with the fixed release 1.3.2-65648 or above.

BeeStation OS 1.3, 1.2, 1.1 and 1.0 require upgrading to 1.3.2-65648 or above to mitigate exploitation risks. The vulnerability was demonstrated live on stage by researchers Tek_7987 and _Anyfun from the Synacktiv offensive security team, underscoring the seriousness of the issue.