CVE-2025-12686
Buffer Overflow in Synology BeeStation Manager AdminCenter
Publication date: 2026-05-27
Last updated on: 2026-05-27
Assigner: Synology Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| synology | beestation_manager | to 1.3.2-65648 (exc) |
| synology | beestation_os | to 1.3.2-65648 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-12686 is a classic buffer overflow vulnerability found in the AdminCenter component of Synology BeeStation Manager (BSM) and BeeStation OS before version 1.3.2-65648. It occurs because the software copies data into a buffer without properly checking the size of the input, which can lead to memory corruption.
This flaw allows remote attackers to execute arbitrary code on the affected system by exploiting unspecified vectors, meaning they can potentially take control of the system remotely.
How can this vulnerability impact me? :
This vulnerability has a high severity with a CVSS base score of 9.8, indicating it poses a critical risk. If exploited, remote attackers can execute arbitrary code on your system without any privileges or user interaction.
The impact includes complete compromise of confidentiality, integrity, and availability of the affected system, potentially allowing attackers to take full control, steal sensitive data, disrupt services, or install malicious software.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, users should immediately upgrade BeeStation OS to version 1.3.2-65648 or later.
Synology has not provided alternative mitigation steps, emphasizing the need for immediate updates.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.