« Volver al listado

CVE-2025-12686

Estado: AnalizadaCrítica (9.8)—

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Buffer overflow remoto sin autenticación (AV:N, PR:N, UI:N) en servicio expuesto permite ejecución arbitraria de código; CWE-120 típico de T1190 con impacto T1059.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningRestrict Web-Based ContentNetwork SegmentationLimit Software InstallationLimit Access to Resource Over Network

Tecnologías afectadas (1)

Synology — Beestation OS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-12686",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-12686",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-27T13:43:56.628449Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@synology.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@synology.com",
      "affectedData": [
        {
          "vendor": "Synology",
          "product": "BeeStation OS",
          "versions": [
            {
              "status": "affected",
              "version": "1.3",
              "lessThan": "1.3.2-65648",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.2",
              "lessThan": "1.3.2-65648",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.1",
              "lessThan": "1.3.2-65648",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.0",
              "lessThan": "1.3.2-65648",
              "versionType": "semver"
            },
            {
              "status": "unknown",
              "version": "0",
              "lessThan": "1.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-05-27T09:16:26.357",
  "references": [
    {
      "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_25_12",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@synology.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@synology.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Copia de búfer sin verificar el tamaño de la entrada ('Desbordamiento de búfer clásico') vulnerabilidad en AdminCenter en Synology BeeStation OS anterior a 1.3.2-65648 permite a atacantes remotos ejecutar código arbitrario a través de vectores no especificados."
    }
  ],
  "lastModified": "2026-09-30T21:10:00.190",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:synology:beestation_os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB4968D5-623C-4FD5-9930-7B4DEFFA9BC6",
              "versionEndExcluding": "1.3.2",
              "versionStartIncluding": "1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@synology.com"
}