A classic buffer overflow flaw (CWE‑120) exists in the AdminCenter module of Synology BeeStation OS when user input is copied into a buffer without size validation. The vulnerability can be triggered remotely, allowing an attacker to overwrite critical memory and execute arbitrary code on the affected device. The impact is severe, with a CVSS base score of 9.8, underscoring the risk of full system compromise.

Synology BeeStation OS firmware versions prior to 1.3.2‑65648 are vulnerable. Any installation running a firmware build dated before this release is at risk until an update is applied.

The EPSS score of 3% indicates a low but non‑zero likelihood of exploitation. The flaw is not yet listed in the CISA KEV catalog. Attackers are likely to exploit the vulnerability over the network via the AdminCenter management interface, though the specific vector is unspecified in the advisory. Without an official workaround, the safest mitigations involve applying the vendor patch or limiting external access to the vulnerable service.