What is the CVSS score of CVE-2025-54158?

CVE-2025-54158 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Beedrive are affected by CVE-2025-54158?

Synology BeeDrive desktop versions prior to 1.4.2-13960 contain a privilege escalation vulnerability that allows local users to execute arbitrary code without authentication, directly compromising…. A patch is available.

How to fix or mitigate CVE-2025-54158?

Within 24 hours: Inventory all Synology BeeDrive desktop installations and identify systems running versions before 1.4.2-13960. Within 7 days: Deploy Synology BeeDrive version 1.4.2-13960 or later to all affected endpoints; prioritize systems handling sensitive data or used by administrative staff. Within 30 days: Verify patch deployment via endpoint management tools and conduct audit of local user access controls on systems that were vulnerable.

Beedrive CVE-2025-54158

EUVD-2025-201167 HIGH

Missing Authentication for Critical Function (CWE-306)

2025-12-04 security@synology.com

Synology Authentication Bypass RCE Beedrive

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:23 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.4.2-13960

EUVD ID Assigned

Mar 15, 2026 - 16:35 euvd

EUVD-2025-201167

Analysis Generated

Mar 15, 2026 - 16:35 vuln.today

CVE Published

Dec 04, 2025 - 16:16 nvd

HIGH 7.8

DescriptionCVE.org

Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.

Analysis

Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.

Technical ContextAI

An authentication bypass vulnerability allows attackers to circumvent login mechanisms and gain unauthorized access without valid credentials. This vulnerability is classified as Missing Authentication for Critical Function (CWE-306).

RemediationAI

Implement robust authentication mechanisms. Use multi-factor authentication. Review authentication logic for bypass conditions. Remove default credentials.