The first day of Pwn2Own Ireland 2025 wrapped up with a record start: 34 unique zero-day vulnerabilities, 17 successful exploits, and no failed attempts — totaling $522,500 in prizes for participating researchers.
Held in Cork, Ireland (October 21-24), the event gathers the world’s best ethical hackers to expose vulnerabilities in everyday connected devices, from printers and routers to NAS and smart-home hubs.
Major Highlights
- Team DDOS (Bongeun Koo & Evangelos Daravigkas): Chained eight exploits to compromise a QNAP Qhora-322 router + TS-453E NAS combo — a $100,000 payday and 10 Master of Pwn points.
- Team Neodyme: Discovered a stack overflow on HP DeskJet 2855e — $20,000.
- Synacktiv: Achieved root code execution on Synology BeeStation Plus — $40,000.
- STARLabs and others: Repeatedly broke Canon imageCLASS MF654Cdw printers, showing just how exploitable everyday devices can be.
- Summoning Team’s Sina Kheirkhah: Used two chained bugs to compromise the Synology DS925+ NAS — $40,000.
- Rapid7’s Stephen Fewer: Combined SSRF and command injection to take control of Home Assistant Green — $40,000.
- Compass Security: Uncovered arbitrary file write + data leak on the same device — $20,000.
- dmdung from STARLabs: Exploited Sonos Era 300 speaker via out-of-bounds access — $50,000.
Master of Pwn Standings (Day 1)
🥇 Summoning Team — 11.5 points ($102,500)
🥈 Team DDOS — 10 points ($100,000)
🥉 Synacktiv, Rapid7, and others — 4 points each
Why It Matters
The competition highlights both the creativity of ethical hackers and the vulnerability of common smart devices. Vendors receive 90 days to patch before disclosure, ensuring the public stays protected.
This year’s Pwn2Own features $2 million in potential rewards, including $1 million for a zero-click WhatsApp exploit, as well as new targets such as the Samsung Galaxy S25 and Meta wearables.
Alcaeus Services Insight
Events like Pwn2Own remind us that security through transparency and testing is key to progress.
At Alcaeus Services, we help organizations adopt responsible disclosure policies, strengthen IoT security, and integrate continuous vulnerability assessment into their infrastructure.
