Synology DiskStation DS925+: information disclosure vulnerability in C2 Identity Plugin

Zero Day Initiative published an advisory about a vulnerability in the C2 Identity Plugin on Synology DiskStation DS925+. Administrators can review the ZDI-26-1009 advisory and Synology’s security advisory for remediation guidance.

Overview and technical details

CVE-2025-14713 is an information disclosure vulnerability in the C2 Identity Plugin. Its CVSS score is 6.5, with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected systems

The affected system identified in the source is Synology DiskStation DS925+, with the C2 Identity Plugin as the relevant component. Specific affected and fixed versions are not provided; Synology has released a corrective update.

Mechanism and impact

The vulnerability is caused by an exposed dangerous function in the C2 Identity Plugin. A nearby attacker can exploit it without authentication to disclose sensitive information, including stored credentials, creating a risk of deeper compromise.

System checks

1. Open DSM, go to Control Panel > Update & Restore, and check the update status. If DSM reports an available update, update according to Synology’s instructions and consult the security advisory to confirm the fix.

   Copy commands

   Mở DSM, vào Control Panel > Update & Restore và kiểm tra trạng thái cập nhật

Remediation and mitigation

1. Install the corrective update according to Synology’s official security guidance: Synology Security Advisory.

2. Consult the official security advisory to confirm the fix for the device.

References

• Zero Day Initiative: ZDI-26-1009
• Synology Security Advisory: Synology_SA_25_18