CVE-2026-13135 is a vulnerability affecting Synology DiskStation DS925+ devices running MailPlus, where the Redis instance is improperly exposed over IPv6 due to misconfigured firewall rules. This exposure allows network-adjacent attackers to access Redis without authentication. While the vulnerability alone has a CVSS base score of 4.3, it can be combined with other vulnerabilities to achieve arbitrary code execution with root privileges. Synology has released an update to address this vulnerability.

An attacker on the network adjacent to the vulnerable device can access the Redis instance without authentication. This unauthorized access could lead to further exploitation, including arbitrary code execution as root when combined with other vulnerabilities. The confidentiality impact is limited to partial information disclosure (C:Low), with no direct integrity or availability impact from this vulnerability alone.

Synology has issued an official update that corrects the firewall misconfiguration exposing the Redis instance. Applying this update is the recommended remediation. No additional mitigation steps are indicated by the vendor advisory.