Synology Security Advisory SA-25:18 on Resolved Vulnerability in C2 Identity Edge Server (PWN2OWN 2025)

Synology, Inc. had published a security advisory on resolved vulnerability in C2 Identity Edge Server.

Publish Time: 2025-12-16 14:22:37 UTC+8
Last Updated: 2025-12-16 14:22:54 UTC+8
Severity: Important
Status: Resolved

Abstract
Synology has released a security update for the C2 Identity Edge Server package in DSM to address ZDI-CAN-28325 :

• CVE-2025-14713 allows remote attackers to obtain user credentials from the edge server

Tefer to the ‘Affected Products’ table for the corresponding updates.

Affected Products

Mitigation: None

Detail:

• CVE-2025-14713
  • Severity: Important
  • CVSS3 Base Score: 7.5
  • CVSS3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • CWE-749: Exposed Dangerous Method or Function
  • ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided

Acknowledgement: Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)

Revision: