Synology DSM CVE-2025-13392

Requires the DSM SSO feature to be configured/enabled on the target NAS - this is not a default-out-of-the-box state, so units without SSO are unaffected. The attacker must additionally possess prior knowledge of a valid distinguished name (DN) for the identity being impersonated, which is the primary factor limiting mass/automated exploitation (consistent with SSVC Automatable: no). No authentication or user interaction is otherwise required (PR:N/UI:N), and the vector is remote over the network. Affected versions are DSM 7.2.2 before 7.2.2-72806-5 and DSM 7.3 before 7.3.1-86003-1; DSM 7.2.1-69057 is explicitly not affected.

Signals are sharply conflicting and warrant careful triage. The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N, full CIA impact) frames this as a critical unauthenticated network authentication bypass, and CISA SSVC rates Technical Impact as 'total' - consistent with a complete auth bypass. However, every exploitation-likelihood signal is low: EPSS is 0.05% (17th percentile), SSVC Exploitation is 'none' and Automatable is 'no', there is no CISA KEV listing, and no public exploit was identified. The 'Automatable: no' rating aligns with the description's key precondition - the attacker must have prior knowledge of a valid distinguished name (DN) and SSO must be configured - which prevents indiscriminate mass scanning and pushes real-world use toward targeted attacks. The CVSS AC:L is arguably generous given that DN foreknowledge is a genuine prerequisite (see assessed vector). Net: this is a genuinely severe flaw where a patch should be applied promptly, but current real-world exploitation pressure is low, not an emergency drop-everything scenario. Priority should be driven by whether SSO is actually enabled on internet-exposed DSM units.

A remote unauthenticated attacker who has already learned a valid distinguished name (DN) - e.g. through LDAP/directory enumeration, prior recon, or organizational knowledge - targets a Synology DSM appliance with SSO enabled and abuses the improper condition check in the SSO flow to authenticate as that identity without valid credentials. No public exploit code has been identified at time of analysis, and SSVC rates the vulnerability as not automatable, so exploitation would be deliberate and targeted rather than opportunistic scanning.