Synology DS925+: Root RCE via Redis MailPlus, Patch Available

ZDI-26-423 reveals a cryptographic flaw in the Synology DS925+ MailPlus Redis component. Network-adjacent attackers achieve unauthenticated root RCE.

The ZDI-26-423 advisory, published July 15, 2026, discloses a vulnerability in the MailPlus Redis component of the Synology DiskStation DS925+ that lets an attacker on the same network execute arbitrary code as root without valid credentials. The attack chain starts with weak encryption in Redis password storage, not a traditional remote service exploit. This shifts the danger to a surface often overlooked in SOHO devices and small businesses.

Key Takeaways

ZDI-26-423 specifically affects the Synology DiskStation DS925+ MailPlus Redis component.
A network-adjacent attacker achieves root RCE without prior authentication.
The flaw is cryptographic: Redis passwords are encrypted in a recoverable format, enabling reuse.
Synology has released a corrective update; coordinated disclosure occurred over seven months after initial reporting.

How a Recoverable Password Opens the NAS

According to the technical dossier published by Zero Day Initiative, the vulnerability resides in the MailPlus Redis instance configuration. The password storage process uses weak encryption that makes passwords recoverable by anyone who can intercept or access them. The advisory does not detail the exact escalation mechanism from password recovery to root code execution, but the logical path is clear: compromised credentials enable authentication to the Redis service or dependent components, projecting full system control.

This attack architecture is particularly insidious because it requires no vulnerabilities in the kernel, web server, or other exposed services. The problem lies in the promise of sensitive data protection — internal service passwords — that proves illusory. The NAS, sold as a secure storage solution for small offices and professionals, exposes a blind spot in an apparently secondary component.

"The specific flaw exists within the configuration of the MailPlus Redis instance. When storing passwords, the process encrypts them in a recoverable format. An attacker can leverage this vulnerability execute code in the context of root." — ZDI Advisory ZDI-26-423

The Distance Between "Network-Adjacent" and "Local"

The attack vector defined by the advisory is "network-adjacent," not "local" or "physical." This distinction has precise operational consequences: the attacker must be on the same network as the victim, but needs neither physical access to the device nor prior compromise of other systems. Guest Wi-Fi networks, multi-tenant environments, shared offices, or corporate network segments with inadequate isolation controls become plausible theaters of action.

The brief does not specify whether particular network conditions are required beyond this topological proximity. It is unclear, for example, whether the exploit requires the Redis service to be exposed on a specific interface or whether the mere presence of the active MailPlus component suffices. This gap in the documentation leaves room for uncertainty in risk assessment for particular deployments.

Seven Months of Coordination, a Patch Without a Version

The disclosure timeline is methodical and revealing: the vulnerability reported on December 4, 2025, became public on July 15, 2026, after over seven months of coordination between the researcher, ZDI, and Synology. This duration is not anomalous for coordinated advisories, but underscores that the fix was available before public disclosure.

What is not in the brief: the exact firmware or MailPlus package version that corrects the flaw. The advisory states that "Synology has issued an update to correct this vulnerability" without specifying the release number. Administrators will have to independently verify update availability through official vendor channels. Equally undocumented is the status of CVE-2025-15660: the record is "reserved" on cve.org, without technically useful details at the time of writing.

What to Do Now

Four priority actions for anyone managing a DS925+ or bearing operational responsibility for one:

Verify the presence of the MailPlus component on the system: if active, the risk is concrete regardless of actual use of the mail functionality.
Install the update released by Synology as soon as it is available in the DSM management panel or official channels, even without the specific version number cited in the advisory.
Isolate the NAS from shared networks or guest segments where unauthorized actors could gain a network-adjacent foothold, reducing the exposure surface to the documented vector.
Review network segmentation if the device resides in multi-tenant environments or those with broad Wi-Fi access: network proximity is the only confirmed prerequisite for the exploit.

The brief provides no guidance on compensating controls, specific monitoring, or verification of past compromise. The recommendation stops at patch application and topological exposure reduction.

Why the ZDI-26-423 Case Is Broader Than a NAS

This vulnerability tells a recurring story in SOHO and SMB hardware: vendors invest in securing the visible perimeter — web servers, VPNs, two-factor authentication — while auxiliary services remain anchored to obsolete cryptographic practices. Redis is not an exotic component in these systems: it is the infrastructure supporting collaborative features, notifications, caching. Its operational invisibility makes it negligible in hardening cycles.

The leap from "recoverable encryption" to "remote root" without authentication is a jump that development teams should prevent by architectural principle, not retroactive fix. That Synology took over seven months to coordinate the patch suggests the complexity of modifying legacy components without breaking internal dependencies. For end users, the lesson is simpler: the security posture of a NAS is not measured by packaging promises, but by the transparency with which the vendor documents — or hides — cryptographic choices in subsystems nobody audits.

Frequently Asked Questions

Is only the DS925+ at risk?

The brief explicitly documents only the DS925+ model as affected. No confirmation emerges that other Synology models share the same cryptographic implementation of the MailPlus Redis component.

What is the CVSS score of the vulnerability?

The ZDI advisory does not report an explicit CVSS score or vector. The CVE-2025-15660 record is in "reserved" status and provides no additional metrics.

Does the attack work remotely over the Internet?

No: the vector is "network-adjacent," which requires topological proximity on the same network. Exploitability from arbitrary remote positions across the Internet is neither documented nor confirmed.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references