EUVD-2025-209957
GHSA-9f49-q57w-cw53
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors.
AnalysisAI
Remote code execution in Synology BeeStation OS versions before 1.3.2-65648 stems from a classic buffer overflow in the AdminCenter component, the device's web-based management interface. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable flaw exploitable by unauthenticated attackers with low complexity and no user interaction, yielding full compromise of confidentiality, integrity, and availability (9.8 Critical). There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the unauthenticated network-RCE profile on a consumer NAS device makes this a high-priority patch target.
Technical ContextAI
BeeStation is Synology's consumer personal-cloud / network-attached-storage appliance, and AdminCenter is its browser-accessible administration console. The root cause is CWE-120, 'Buffer Copy without Checking Size of Input' (Classic Buffer Overflow): input is copied into a fixed-size memory buffer without validating that the input length fits, allowing adjacent memory - including return addresses or control structures - to be overwritten. Because AdminCenter is the privileged management surface, a successful overwrite that redirects execution typically runs code in the context of the administrative web service, which on appliances like this is often highly privileged. No CPE strings were supplied in the input; affected scope is defined by the BeeStation OS version boundary in the description rather than by enumerated CPEs.
RemediationAI
Apply the vendor fix by upgrading to BeeStation OS 1.3.2-65648 or later (Vendor-released patch: 1.3.2-65648), as documented in Synology advisory SA_25_12 at https://www.synology.com/en-global/security/advisory/Synology_SA_25_12; this is the primary and only confirmed remediation. Because the input lists no vendor-provided workaround, the recommended compensating control until patching is to remove the AdminCenter management interface from internet exposure - disable QuickConnect/external port forwarding to the device and restrict the admin web ports (typically the BeeStation management HTTP/HTTPS ports) to trusted LAN hosts or a VPN, accepting the trade-off that remote administration and remote file access will be unavailable until access is restored. Network-layer firewall rules limiting source IPs to known administrators reduce the attack surface but do not remediate the underlying overflow, so they are a stopgap, not a substitute for the update.
More from same product – last 7 days
Authentication bypass in Synology DiskStation Manager (DSM) SSO lets remote, unauthenticated attackers who already know
Credential disclosure in Synology C2 Identity Edge Server (DSM versions before 1.76.0-0307) allows remote unauthenticate
Volume encryption in Synology Storage Manager before version 1.0.1-1100 transmits sensitive data via HTTP GET query stri
Arbitrary file write with restricted content in Synology ActiveProtect Agent before 1.1.0-0439 is exploitable by local u
Synology Active Backup for Business Agent before version 3.1.0-4967 contains an origin validation error (CWE-346) that p
Share
External POC / Exploit Code
Leaving vuln.today