What is the CVSS score of CVE-2025-13392?

CVE-2025-13392 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Synology DSM are affected by CVE-2025-13392?

Synology NAS storage systems face a critical authentication bypass (CVSS 8.1) that enables unauthorized data access; while no public exploit identified at time of analysis, the vulnerability severity…. A patch is available.

How to fix or mitigate CVE-2025-13392?

Within 24 hours: Identify and document all Synology DSM instances in your environment. Within 7 days: Apply vendor-released patches from Synology to all DSM systems, prioritizing those containing sensitive data or business-critical information. Within 30 days: Validate patch deployment across all Synology infrastructure and confirm vulnerability remediation through vulnerability scanning.

Synology DSM CVE-2025-13392

EUVD-2025-209956 HIGH

Improper Check for Unusual or Exceptional Conditions (CWE-754)

2026-05-27 security@synology.com

GHSA-g37m-8w79-wgp5

Synology Authentication Bypass

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:21 vuln.today

Patch available

May 27, 2026 - 19:46 EUVD

DescriptionCVE.org

Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge of the distinguished name (DN).

AnalysisAI

Authentication bypass in Synology DiskStation Manager (DSM) SSO lets remote, unauthenticated attackers who already know a valid account's distinguished name (DN) impersonate that identity and gain access to the NAS, with high confidentiality, integrity, and availability impact (CVSS 8.1). The flaw stems from an improper check of an exceptional condition (CWE-754) in the single sign-on flow. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.05%, 17th percentile), consistent with the high attack complexity Synology assigned.

Technical ContextAI

The affected component is the single sign-on (SSO) subsystem of Synology DiskStation Manager (DSM), the web-based operating system for Synology NAS appliances. The root cause is classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions): a code path in the SSO authentication logic fails to properly validate or handle an exceptional state, so an attacker who supplies a known distinguished name (DN) - the LDAP/directory-style identifier of an existing principal - can pass the authentication gate without supplying valid credentials. The distinguished name is a directory-service concept, indicating the SSO integration ties into a directory backend where DNs identify users; knowledge of a valid DN is the gating prerequisite the CVSS team modeled as high attack complexity (AC:H). No CPE strings were supplied in the input, so exact platform identifiers cannot be enumerated beyond the DSM version ranges provided.

RemediationAI

Apply the vendor-released patch: upgrade DSM to 7.3.1-86003-1 (for the 7.3 branch) or 7.2.2-72806-5 (for the 7.2.2 branch); DSM 7.2.1-69057 is already unaffected and can serve as a known-good baseline if upgrade scheduling is constrained. Because the vulnerability lives in the SSO flow, an effective interim compensating control is to disable SSO on the DSM instance until patching, which closes the exploitable path at the cost of removing single sign-on convenience for users. Additionally, restrict network exposure of the DSM web/SSO interface - do not expose DSM directly to the internet; place it behind a VPN or restrict the management interface to trusted source IPs, which limits who can reach the vulnerable endpoint but does not remediate the flaw itself. Treat any directory distinguished names as sensitive to reduce the chance an attacker can satisfy the DN precondition. See the Synology advisory at https://www.synology.com/en-global/security/advisory/Synology_SA_25_14 for authoritative fixed-version details.