ZDI-CAN-28554
HIGH 8.8
Overdue
Dec 04, 2025
Synology
Synology is a network-attached storage (NAS) and surveillance system vendor. This high-severity vulnerability (CVSS 8.8) can be exploited locally without authentication or user interaction, potentially compromising confidentiality, integrity, and availability of affected systems. Security teams should monitor for patches from Synology due April 3, 2026, and restrict local network access to vulnerable devices until updates are available.
Advisory Details
Researcher
Discovered by:
gcali (_gcali)
Reported
December 04, 2025
Deadline
April 03, 2026
14d overdue
CVSS Vector
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H