ZDI-CAN-28325: ZDI-26-1009: (Pwn2Own) Synology DiskStation DS925+ C2 Identity Plugin Exposed Dangerous Method Information Disclosure Vulnerability
Published Nov 13, 2026
·Updated
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Synology DiskStation DS925+ devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2025-14713.
Event History
Nov 13, 2026
Advisory Published
via ZDI·06:00 AM
Data Sourced
via ZDI·06:00 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
A network-adjacent attacker can exploit the vulnerability against affected Synology DiskStation DS925+ installations. Authentication is not required.
2
What is the impact of successful exploitation?
Successful exploitation allows disclosure of sensitive information from the affected device.
3
How severe is this vulnerability?
ZDI assigned this issue a CVSS rating of 6.5.