ZDI-26-423: Synology DiskStation DS925+ MailPlus Redis Weak Cryptography for Passwords Remote Code Execution Vulnerability

Published Jul 15, 2026

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation DS925+ devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-15660.

Affected Software

1 affected component

Synology DiskStation DS925+

Event History

Jul 15, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-26-423?

ZDI-26-423 has a CVSS rating of 8.8, indicating a high severity vulnerability.

How do I fix ZDI-26-423?

To fix ZDI-26-423, update your Synology DiskStation DS925+ to the latest firmware version released by Synology.

What type of attack does ZDI-26-423 facilitate?

ZDI-26-423 allows network-adjacent attackers to execute arbitrary code on the affected Synology DiskStation DS925+ devices.

Is authentication required to exploit ZDI-26-423?

No, authentication is not required to exploit the ZDI-26-423 vulnerability.

Which software is affected by ZDI-26-423?

The vulnerability ZDI-26-423 affects the Synology DiskStation DS925+ device.