(Pwn2Own) Synology DiskStation DS925+ C2 Identity Plugin Exposed Dangerous Method Information Disclosure Vulnerability

November 13th, 2026
ZDI-26-1009 ZDI-CAN-28325

CVE ID

CVE-2025-14713

CVSS Score

6.5 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Vendors

Synology

Affected Products

DiskStation DS925+

Vulnerability Details

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Synology DiskStation DS925+ devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the C2 Identity Plugin. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.

Additional Details

Synology has issued an update to correct this vulnerability. More details can be found at:
https://www.synology.com/en-br/security/advisory/Synology_SA_25_18

Disclosure Timeline

  • 2025-11-18 - Vulnerability reported to vendor
  • 2026-11-13 - Coordinated public release of advisory
  • 2026-11-13 - Advisory Updated

Credit

Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)

Back to Advisories