ZDI-CAN-25662: ZDI-25-210: (Pwn2Own) Synology BeeStation BST150-4T Improper Input Validation Remote Code Execution Vulnerability

Published Apr 9, 2025

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology BeeStation BST150-4T devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2024-10445.

Affected Software

1 affected component

Synology BeeStation BST150-4T

Event History

Apr 9, 2025

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-25662?

The vulnerability ZDI-CAN-25662 has been assigned a CVSS rating of 7.5, indicating a high severity.

How do I fix ZDI-CAN-25662?

To mitigate ZDI-CAN-25662, users should apply the latest firmware updates provided by Synology for the BeeStation BST150-4T devices.

Who is affected by ZDI-CAN-25662?

ZDI-CAN-25662 affects installations of the Synology BeeStation BST150-4T devices.

Can an attacker exploit ZDI-CAN-25662 remotely?

Yes, ZDI-CAN-25662 allows network-adjacent attackers to execute arbitrary code without the need for authentication.

What type of vulnerability is ZDI-CAN-25662?

ZDI-CAN-25662 is a code execution vulnerability that can be exploited to execute arbitrary code on affected devices.