What is the CVSS score of CVE-2025-14713?

CVE-2025-14713 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Synology C2 Identity are affected by CVE-2025-14713?

A credential disclosure vulnerability in Synology C2 Identity Edge Server (DSM versions before 1.76.0-0307) allows unauthenticated remote attackers to extract user credentials over the network.. A patch is available.

How to fix or mitigate CVE-2025-14713?

24 hours: Inventory all Synology C2 Identity Edge Server deployments and document current DSM versions; restrict network access to affected systems if possible. 7 days: Deploy vendor patch to DSM 1.76.0-0307 or later in non-production environments and validate functionality. 30 days: Complete production deployment and conduct credential audit to identify unauthorized access attempts during the vulnerability window.

Synology C2 Identity CVE-2025-14713

EUVD-2025-209959 HIGH

Exposed Dangerous Method or Function (CWE-749)

2026-05-27 security@synology.com

GHSA-jmjf-jwvm-x7jx

Synology Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:00 vuln.today

Patch available

May 27, 2026 - 19:46 EUVD

DescriptionCVE.org

An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain user credentials from the edge server.

AnalysisAI

Credential disclosure in Synology C2 Identity Edge Server (DSM versions before 1.76.0-0307) allows remote unauthenticated attackers to retrieve user credentials directly from the edge server over the network. The flaw stems from an exposed dangerous method/function (CWE-749) reachable without authentication, yielding a high-confidentiality impact with no integrity or availability effect. No public exploit has been identified at time of analysis, and EPSS scores it at the bottom 7th percentile, indicating low near-term exploitation likelihood despite the network-reachable vector.

Technical ContextAI

Synology C2 Identity is Synology's cloud-based identity and access management (IAM) service, and the Edge Server is an on-premises package deployed on DSM (DiskStation Manager) appliances to bridge local directory/authentication services with the C2 Identity cloud - making it a sensitive component that handles user identity data and credentials. The root cause is classified as CWE-749 (Exposed Dangerous Method or Function), meaning a method or function intended for internal or privileged use is reachable through an external interface without adequate access control. In this case that exposed functionality permits retrieval of user credentials from the edge server. The EUVD-tracked affected component is the C2 Identity Edge Server package on all versions prior to 1.76.0-0307; no granular CPE strings were provided in the input beyond this version-bounded identifier.

RemediationAI

Apply the vendor-released patch: upgrade the C2 Identity Edge Server package to version 1.76.0-0307 or later, per Synology advisory SA_25_18 (https://www.synology.com/en-global/security/advisory/Synology_SA_25_18). No vendor workaround was published in the available data, so patching is the primary and recommended action. Until the update is applied, reduce exposure by restricting network reachability of the edge server - limit inbound access to the package's service ports to trusted management networks or place it behind a VPN/firewall ACL so it is not reachable from untrusted networks; the trade-off is that overly tight restrictions could disrupt legitimate identity-bridging traffic between on-premises directories and the C2 Identity cloud, so scope the rules to known C2 Identity endpoints. After patching, treat any credentials that may have been exposed as potentially compromised and rotate them.