This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Synology fixes 3 vulnerabilities
Synology fixes 3 vulnerabilities in the Assistant, Active Backup for Business Agent and C2 Identity Edge Server for DSM products [1][2][3]. Products and fixed versions: Synology Assistant - 7.0.6-50085 [1] Synology Active Backup for Business Agent - 3.1.0-4967 [2] Synology C2 Identity Edge Server for DSM - 1.76.0-0307 [3]
An unauthenticated local attacker can write arbitrary files with restrictive content in the Assistant and Active Backup for Business Agent products [1].
The vulnerability is present in products:
- Synology Assistant; <7.0.6-50085
- Synology Active Backup for Business Agent; <3.1.0-4967
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
More information:
- CVE-2025-66593 at cve.org, NVD
- CVE-2025-66592 at cve.org, NVD
- CWE-346: Origin Validation Error at cwe.mitre.org
The vulnerability was publicly disclosed 8. 12. 2025.
An unauthenticated remote attacker can obtain user credentials in the C2 Identity Edge Server for DSM product [3].
The vulnerability is present in product:
- C2 Identity Edge Server for DSM; <1.76.0-0307
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2025-14713 at cve.org, NVD
- CWE-749: Exposed Dangerous Method or Function at cwe.mitre.org
The vulnerability was publicly disclosed 16. 12. 2025.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 18. 12. 2025.