VulnSocial

CVE-2025-12686Patch(synology / beestation_os)

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch synology beestation_os systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors.

synology CVEsBack to dashboard
2.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-120

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • beestation_os

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Peaked 1d ago at 1 mentions (2026-05-27); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
synology
Products
beestation_os

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-05-27: 1Mentions · 2026-05-28: 1PoC Mentioned / Linked · 2026-05-28: 1Patch / Workaround · 2026-05-27: 1Patch / Workaround · 2026-05-28: 1Technical Details · 2026-05-27: 1Technical Details · 2026-05-28: 105-2705-28
Signal classification1 categories
Patch
2100.0%
Referenced assets1 URL
By indicator
Full discourse2 posts
  • Orizon@OrizonCyber
    Patch

    🚨 CVE-2025-12686 — CVSS 9.8/10 ██████████ Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/0KEI8l7aQS

    Post summary

    The tweet alerts users to a critical buffer overflow vulnerability (CVE‑2025‑12686) in Synology's AdminCenter and urges applying the available patch.

    1000087
    43 followersView on X
  • SecAlerts@SecAlertsCo
    Patch

    Synology BeeStation OS has a critical (9.8) buffer overflow in AdminCenter - unauthenticated RCE, no interaction needed. Zero-day demoed at Pwn2Own. Update to 1.3.2-65648+ now. CVE-2025-12686 https://secalerts.co/vulnerability/CVE-2025-12686 https://t.co/AirQmTQ5ti

    Post summary

    Synology BeeStation OS suffers a critical buffer overflow enabling unauthenticated RCE; a PoC was demonstrated at Pwn2Own and the flaw is fixed by updating to version 1.3.2‑65648+.

    0000079
    826 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
OSsynologybeestation_os---

Explore more

Back to dashboardsynology CVEsbeestation_os vulnerabilities