Hackers Unleash 34 Zero-Day Exploits on Day One of Pwn2Own Ireland 2025

A Record-Breaking Start to the Year’s Most Prestigious Hacking Competition

In a stunning display of technical mastery, Day One of Pwn2Own Ireland 2025 ended with researchers successfully demonstrating 34 zero-day vulnerabilities across a wide range of consumer devices. Within a single day, competitors collectively earned $522,500 in prizes, setting a powerful tone for the rest of the event. The opening day’s flawless 100% success rate — with not a single failed attempt — marked one of the most impressive starts in the competition’s history.

The annual Pwn2Own event, hosted by the Zero Day Initiative (ZDI), is the world’s most respected battleground for ethical hackers. It provides a stage for researchers to expose hidden security weaknesses in real-world products, from routers to smart home devices. What makes 2025’s Ireland edition extraordinary is not just the payout, but the variety, depth, and sophistication of the attacks displayed — proof that consumer technology remains a rich hunting ground for vulnerabilities.

The Powerhouses of Day One: Breaking Barriers and Devices Alike

Teams took on 17 distinct exploitation challenges, targeting consumer hardware including printers, smart home hubs, NAS (Network Attached Storage) devices, and routers. Among them, Team DDOS, made up of Bongeun Koo and Evangelos Daravigkas, stole the early spotlight. Their “SOHO Smashup” chained together eight separate vulnerabilities to breach both a QNAP Qhora-322 router and a QNAP TS-453E NAS, netting $100,000 and 10 Master of Pwn points — the competition’s internal scoring system for overall dominance.

Smart home and storage devices were the day’s prime targets. The Philips Hue Bridge, Home Assistant Green, and Synology storage appliances were successfully compromised by multiple teams, showcasing the security fragility of connected home ecosystems. Sina Kheirkhah of the Summoning Team proved to be one of the event’s standout talents, achieving multiple successful exploits. His team’s final strike on the Synology ActiveProtect Appliance DP320 earned them another $50,000, pushing their total rewards dramatically higher.

Printers — often underestimated as cyber threats — also took a beating. The Canon imageCLASS MF654Cdw was exploited four different times using various heap-based and stack-based buffer overflow methods. Meanwhile, Team Neodyme broke through an HP DeskJet 2855e, earning $20,000 through a meticulously executed stack-based buffer overflow attack.

One of the most captivating hacks of the day came from DMDung of STAR Labs, who leveraged a single out-of-bounds access vulnerability to compromise the Sonos Era 300 smart speaker. The exploit’s precision earned him $50,000 and five Master of Pwn points, highlighting both his technical expertise and the hidden risks in modern audio devices.

Deep Dive: The Techniques Behind the Triumph

The diversity of the vulnerabilities revealed how layered and complex modern attack surfaces have become. Competitors employed command injections, authentication bypasses, format string vulnerabilities, and SSRF (Server-Side Request Forgery) exploits to gain access and control.

Among the notable demonstrations, Stephen Fewer from Rapid7 executed three separate exploits — including a command injection and SSRF — on the Home Assistant Green. In contrast, the DEVCORE Research Team showcased a rare format string vulnerability against a QNAP device, underlining how even obscure coding oversights can lead to full system compromise.

As these vulnerabilities are now being responsibly disclosed, manufacturers like Canon, QNAP, HP, Synology, and Sonos will rush to release security patches. The competition’s responsible disclosure policy ensures that these flaws are fixed before malicious actors can replicate the techniques — strengthening global cybersecurity in the process.

With two more days left in the event and high-profile targets still awaiting their turn, experts predict that the total prize pool could surpass $1 million by the competition’s end. For ethical hackers, it’s not just about money — it’s about driving the industry forward and reinforcing the importance of proactive defense in an increasingly digital world.

What Undercode Say:

Pwn2Own Ireland 2025 serves as a vivid reminder that cybersecurity is never static. What we’re seeing this year is not merely a contest of skill, but an evolving dialogue between technology and vulnerability. The 34 successful zero-day exploits in a single day illustrate an uncomfortable truth — that even the most respected consumer brands still harbor significant security flaws.

From an analytical standpoint, several insights stand out. First, network-attached storage (NAS) and smart home devices continue to dominate as attack surfaces. Their constant connectivity, coupled with limited update mechanisms, make them lucrative targets. Second, the cross-disciplinary approach of the hackers — chaining hardware, firmware, and software vulnerabilities together — reflects a growing sophistication that traditional defense models are struggling to match.

Team DDOS’s SOHO Smashup wasn’t just a clever exploit chain; it symbolized the future of cyberattacks — multi-layered, precise, and elegantly orchestrated. Similarly, the Sonos exploit demonstrated that even entertainment devices, often overlooked, can become critical points of compromise in home networks.

What’s particularly intriguing is how attackers are blending old-school exploit techniques (like buffer overflows) with modern network manipulation tactics. This hybridization suggests that cybersecurity education must evolve accordingly, teaching future defenders not just how to code securely, but how to think adversarially.

Economically, Pwn2Own also reveals how the vulnerability marketplace has matured. A half-million dollars in one day reflects the growing financial incentive behind ethical hacking — a positive trend, since it channels hacker creativity into legal, beneficial outcomes. By providing both recognition and reward, events like this transform what could have been underground cybercrime into a legitimate profession of high value.

Finally, the human aspect should not be ignored. Behind each exploit lies days or weeks of relentless testing, trial, and reverse engineering. These researchers represent the quiet heroes of digital security — the ones who break systems to rebuild them stronger.

As the competition continues, we can expect to see new frontiers being challenged — from automotive systems to IoT medical devices. The ripple effect of this event will extend far beyond Ireland, shaping how manufacturers, researchers, and governments approach security in 2026 and beyond.

🔍 Fact Checker Results

✅ Pwn2Own Ireland 2025 confirmed 34 successful zero-day exploits on Day One.
✅ Total payout verified at $522,500, with no failed attempts recorded.
✅ All vulnerabilities to be disclosed responsibly to affected vendors.

📊 Prediction

🔮 As the next two days unfold, total earnings may easily exceed $1 million, setting a new benchmark in Pwn2Own history.
🧠 Expect more complex multi-chain exploits targeting hybrid systems such as smart routers and IoT hubs.
🌐 These findings will accelerate firmware security updates across consumer tech by early 2026, reshaping digital defense worldwide.