Synology BeeStation CVE-2025-12686

Exploitation requires network reachability to the AdminCenter management interface of a Synology BeeStation running BeeStation OS earlier than 1.3.2-65648; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are needed, so default-configured devices whose admin interface is reachable are exploitable. The practical limiting factors are: the AdminCenter port must be reachable from the attacker (LAN access, or internet exposure via port-forwarding/QuickConnect), and the exact triggering input is undisclosed ('unspecified vectors'), meaning an attacker must independently discover the vector since no public exploit exists. Devices kept strictly on an internal network with no inbound exposure substantially reduce, though do not eliminate, realistic risk.

All available CVSS signals point to maximum severity: AV:N (network), AC:L (low complexity), PR:N (no privileges), UI:N (no interaction), and C:H/I:H/A:H produce the 9.8 base score, describing trivially reachable unauthenticated RCE. Tempering this, several real-world signals are absent from the input: no EPSS exploitation-probability score was provided, the CVE is not in CISA KEV (no active exploitation), and no proof-of-concept is referenced - so there is no public exploit identified at time of analysis. The description's 'via unspecified vectors' wording means the exact triggering request is not disclosed, which modestly raises the bar for opportunistic attackers while not reducing the underlying severity. Net assessment: this is a genuine high priority due to the unauthenticated-network-RCE profile on an internet-capable storage appliance, even though there is currently no evidence of in-the-wild exploitation. Note that BeeStation devices are frequently exposed to the internet for remote access, which would materially increase exposure if the management interface is reachable.

An attacker who can reach a BeeStation's AdminCenter interface - for example a device exposed to the internet or reachable on a compromised LAN - sends a crafted oversized request to the vulnerable handler, overflowing a fixed-size buffer and overwriting control data to redirect execution into attacker-supplied code. Given AV:N/AC:L/PR:N/UI:N, this requires no credentials and no victim interaction, granting full control of the storage appliance and its data. No public exploit is identified at time of analysis, and the precise vector is undisclosed ('unspecified vectors'), so a working attack would require reverse-engineering the patched component.