Synology DiskStation DS925+ MailPlus Improper Restriction of Communication Channel to Intended Endpoints Vulnerability

July 15th, 2026
ZDI-26-424 ZDI-CAN-28485

CVE ID

CVE-2026-13135

CVSS Score

4.3 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected Vendors

Synology

Affected Products

DiskStation DS925+

Vulnerability Details

This vulnerability allows network-adjacent attackers to access the Redis instance on affected installations of Synology DiskStation DS925+ devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the configuration of the MailPlus firewall rules. The issue results from exposing the Redis instance over IPv6. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.

Additional Details

Synology has issued an update to correct this vulnerability. More details can be found at:
https://www.synology.com/en-global/security/advisory/Synology_SA_26_11

Disclosure Timeline

  • 2025-12-04 - Vulnerability reported to vendor
  • 2026-07-15 - Coordinated public release of advisory
  • 2026-07-15 - Advisory Updated

Credit

gcali (_gcali)

Back to Advisories