by Kastro
Paper/Archive/CVE-2025-13392

CVE-2025-13392

Synology DiskStation Manager (DSM) — Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and…

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 45.0.450 × 209.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge of the distinguished name (DN).

Affected

ProductAffectedFixed inSource
DiskStation Manager (DSM)7.3 – < 7.3.1-86003-17.3.1-86003-1CNA
DiskStation Manager (DSM)7.2.2 – < 7.2.2-72806-57.2.2-72806-5CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
synology (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorysynology.com/en-global/security/advisory/Synology_SA_25_14