ZDI-CAN-28554: ZDI-26-423: Synology DiskStation DS925+ MailPlus Redis Weak Cryptography for Passwords Remote Code Execution Vulnerability

Published Jul 15, 2026

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation DS925+ devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-15660.

Affected Software

1 affected component

Synology DiskStation DS925+

Event History

Jul 15, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-28554?

The CVSS rating for ZDI-CAN-28554 is 8.8, indicating a high severity vulnerability.

How do I fix ZDI-CAN-28554?

To mitigate ZDI-CAN-28554, update your Synology DiskStation DS925+ to the latest firmware version provided by Synology.

What types of attacks can ZDI-CAN-28554 facilitate?

ZDI-CAN-28554 allows attackers to execute arbitrary code on vulnerable Synology DiskStation DS925+ devices without requiring authentication.

Which devices are affected by ZDI-CAN-28554?

ZDI-CAN-28554 specifically impacts the Synology DiskStation DS925+ models.

Is authentication required to exploit ZDI-CAN-28554?

No, authentication is not required to exploit the ZDI-CAN-28554 vulnerability.