Synology C2 Identity CVE-2025-14713

Exploitation requires network reachability to a deployed Synology C2 Identity Edge Server package running a DSM build earlier than 1.76.0-0307; the exposed dangerous function is callable remotely without authentication (CVSS PR:N) and without user interaction (UI:N), so no credentials or victim action are needed. The principal limiting factors are deployment-based rather than configuration-based: the target organization must actually run the C2 Identity Edge Server package (a specific Synology IAM bridging component, not a default DSM service), and the attacker must be able to reach its service interface over the network - meaning edge servers isolated behind firewalls/VPNs or not exposed to untrusted networks are not practically reachable. Impact is confined to confidentiality (credential disclosure, C:H); the flaw does not by itself permit modification or denial of service (I:N/A:N).

Signals are mixed and point to a real-but-not-urgent issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes an easily reachable, network-based, unauthenticated information disclosure - high severity for confidentiality because credentials are exposed, but scope-unchanged with no integrity or availability impact. Against that, EPSS is only 0.03% (7th percentile) and there is no KEV listing and no public exploit identified, so widespread or imminent exploitation is not indicated. CISA SSVC reinforces this: Exploitation=none (no observed activity), Automatable=yes (the unauthenticated network flaw could be scripted at scale if an exploit emerged), Technical Impact=partial. The combination of 'Automatable: yes' with 'Exploitation: none' means the bug is theoretically scalable but not currently being used, so prioritization should be driven by the sensitivity of exposed credentials rather than by active-threat pressure. No conflicting data was found: the description (remote attacker, credential theft) is consistent with the CVSS network/PR:N/C:H vector.

An attacker with network access to an unpatched C2 Identity Edge Server invokes the exposed function/endpoint without authentication and receives user credentials returned by the server. Because no user interaction or privileges are required (AV:N/AC:L/PR:N/UI:N) and the action is automatable, the harvested credentials could then be used for follow-on account takeover or lateral movement into the connected identity environment. No public proof-of-concept exploit has been identified at time of analysis.