What is the CVSS score of CVE-2025-12686?

CVE-2025-12686 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Synology BeeStation are affected by CVE-2025-12686?

Synology BeeStation OS (before v1.3.2-65648) contains a critical remote code execution vulnerability (CVE-2025-12686, CVSS 9.8) allowing unauthenticated network attackers to fully compromise affected…. A patch is available.

How to fix or mitigate CVE-2025-12686?

Within 24 hours: Identify all Synology BeeStation devices in inventory; assess network accessibility of AdminCenter interface; restrict access via firewall to authorized administrators only. Within 7 days: monitor Synology security advisories daily and prepare patch testing environment. Within 30 days: deploy vendor patch version 1.3.2-65648 or later to all production devices as soon as released.

Synology BeeStation CVE-2025-12686

EUVD-2025-209957 CRITICAL

Classic Buffer Overflow (CWE-120)

2026-05-27 security@synology.com

GHSA-9f49-q57w-cw53

RCE Synology Buffer Overflow

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 27, 2026 - 19:46 EUVD

Analysis Generated

May 27, 2026 - 19:45 vuln.today

DescriptionCVE.org

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors.

AnalysisAI

Remote code execution in Synology BeeStation OS versions before 1.3.2-65648 stems from a classic buffer overflow in the AdminCenter component, the device's web-based management interface. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable flaw exploitable by unauthenticated attackers with low complexity and no user interaction, yielding full compromise of confidentiality, integrity, and availability (9.8 Critical). There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the unauthenticated network-RCE profile on a consumer NAS device makes this a high-priority patch target.

Technical ContextAI

BeeStation is Synology's consumer personal-cloud / network-attached-storage appliance, and AdminCenter is its browser-accessible administration console. The root cause is CWE-120, 'Buffer Copy without Checking Size of Input' (Classic Buffer Overflow): input is copied into a fixed-size memory buffer without validating that the input length fits, allowing adjacent memory - including return addresses or control structures - to be overwritten. Because AdminCenter is the privileged management surface, a successful overwrite that redirects execution typically runs code in the context of the administrative web service, which on appliances like this is often highly privileged. No CPE strings were supplied in the input; affected scope is defined by the BeeStation OS version boundary in the description rather than by enumerated CPEs.

RemediationAI

Apply the vendor fix by upgrading to BeeStation OS 1.3.2-65648 or later (Vendor-released patch: 1.3.2-65648), as documented in Synology advisory SA_25_12 at https://www.synology.com/en-global/security/advisory/Synology_SA_25_12; this is the primary and only confirmed remediation. Because the input lists no vendor-provided workaround, the recommended compensating control until patching is to remove the AdminCenter management interface from internet exposure - disable QuickConnect/external port forwarding to the device and restrict the admin web ports (typically the BeeStation management HTTP/HTTPS ports) to trusted LAN hosts or a VPN, accepting the trade-off that remote administration and remote file access will be unavailable until access is restored. Network-layer firewall rules limiting source IPs to known administrators reduce the attack surface but do not remediate the underlying overflow, so they are a stopgap, not a substitute for the update.