CVE-2025-2848

MediumCVSS 6.3/10Last modified Sep 25, 2026

Description

A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and disable some non-critical functions.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Synology	Synology Mail Server	< 1.7.6-10676; < 1.7.6-20676

References

https://www.synology.com/en-global/security/advisory/Synology_SA_25_05Vendor Advisory

Timeline

Published: Dec 4, 2025
Last modified: Sep 25, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-28495.5A vulnerability, which was classified as problematic, was found in UPX up to 5.0.0. Affected is the function PackLinuxElf64::un_DT_INIT of t CVE-2025-28503.5A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX18 CVE-2025-28518.0A vulnerability classified as critical has been found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, CVE-2025-28524.7A vulnerability has been found in SourceCodester Food Ordering Management System up to 1.0 and classified as critical. Affected by this vuln CVE-2025-28536.5An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of CVE-2025-28548.8A vulnerability classified as critical was found in code-projects Payroll Management System 1.0. Affected by this vulnerability is an unknow CVE-2025-28557.2A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is the function che CVE-2025-285710.0Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compr CVE-2025-28588.8Privilege escalation vulnerability in the saTECH BCU firmware version 2.1.3. An attacker with access to the CLI of the device could make use CVE-2025-28599.8An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and m CVE-2025-28605.3SaTECH BCU in its firmware version 2.1.3, allows an authenticated attacker to access information about the credentials that users have withi CVE-2025-28617.5SaTECH BCU in its firmware version 2.1.3 uses the HTTP protocol. The use of the HTTP protocol for web browsing has the problem that informat