Pwn2Own Ireland 2025: 73 zero-days disclosed in printers, NAS, smart home devices and phones, $1,024,750 awarded
Trend Micro announced that contestants at Pwn2Own Ireland 2025 discovered and disclosed 73 unique zero-day vulnerabilities across printers, network storage systems, smart home devices, surveillance equipment, home networking equipment, flagship smartphones and wearables. A total of $1,024,750 was awarded from a prize pool of over $2 million. Trend says research from the event lets it protect customers from zero-day exploits an average of 71 days ahead of the industry. The vulnerabilities were disclosed through the Zero Day Initiative (ZDI) so vendors can patch them. The article does not report in-the-wild exploitation, CVE identifiers or patch status.
Technical Details
- Samsung Galaxy S25: Interrupt Labs (Ben R., Georgi G.) used an improper input validation bug to exploit the phone, including its camera and location tracking ($50,000). Ken Gannon (Mobile Hacking Lab) and Dimitrios Valsamaras (Summoning Team) chained five bugs for another $50,000.
- QNAP Qhora-322 router and TS-453E NAS: Team DDOS (Bongeun Koo, Evangelos Daravigkas) chained eight bugs, including multiple injections, in a "SOHO Smashup" ($100,000).
- Sonos Era 300: dmdung of STAR Labs SG used a single out-of-bounds (OOB) access bug ($50,000).
- Synology ActiveProtect Appliance DP320: Sina Kheirkhah and McCaulay Hudson (Summoning Team) exploited two vulnerabilities.
- WhatsApp: Team Z3 withdrew its zero-click exploit attempt. The research was shared privately with Trend Micro ZDI and Meta for patching.
Remediation
- Watch for vendor patches from Samsung, QNAP, Sonos, Synology and Meta for the disclosed issues, and apply them promptly once released.
- Reduce exposure of SOHO routers, NAS and IoT devices until fixes are available.
- The next event, Pwn2Own Automotive, is scheduled for Tokyo on January 21-23, 2026.
Linha do tempo
-
Pwn2Own Ireland 2025: 73 zero-days disclosed in printers, NAS, smart home devices and phones, $1,024,750 awarded
ler a análise desta fonte ocultar
Trend Micro announced that contestants at Pwn2Own Ireland 2025 discovered and disclosed 73 unique zero-day vulnerabilities across printers, network storage systems, smart home devices, surveillance equipment, home networking equipment, flagship smartphones and wearables. A total of $1,024,750 was awarded from a prize pool of over $2 million. Trend says research from the event lets it protect customers from zero-day exploits an average of 71 days ahead of the industry. The vulnerabilities were disclosed through the Zero Day Initiative (ZDI) so vendors can patch them. The article does not report in-the-wild exploitation, CVE identifiers or patch status.
Technical Details
- Samsung Galaxy S25: Interrupt Labs (Ben R., Georgi G.) used an improper input validation bug to exploit the phone, including its camera and location tracking ($50,000). Ken Gannon (Mobile Hacking Lab) and Dimitrios Valsamaras (Summoning Team) chained five bugs for another $50,000.
- QNAP Qhora-322 router and TS-453E NAS: Team DDOS (Bongeun Koo, Evangelos Daravigkas) chained eight bugs, including multiple injections, in a "SOHO Smashup" ($100,000).
- Sonos Era 300: dmdung of STAR Labs SG used a single out-of-bounds (OOB) access bug ($50,000).
- Synology ActiveProtect Appliance DP320: Sina Kheirkhah and McCaulay Hudson (Summoning Team) exploited two vulnerabilities.
- WhatsApp: Team Z3 withdrew its zero-click exploit attempt. The research was shared privately with Trend Micro ZDI and Meta for patching.
Remediation
- Watch for vendor patches from Samsung, QNAP, Sonos, Synology and Meta for the disclosed issues, and apply them promptly once released.
- Reduce exposure of SOHO routers, NAS and IoT devices until fixes are available.
- The next event, Pwn2Own Automotive, is scheduled for Tokyo on January 21-23, 2026.