External risk intelligence

Synology DSM Authentication Bypass via Improper SSO Check

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-13392

Synology DiskStation Manager is frequently deployed as an internet-facing administrative and storage portal. The vulnerability exists within the SSO mechanism, which is designed to be accessible to users over the network, making this an internet-reachable authentication surface by design in many common deployments.

Synology Diskstation Manager

7.2.2 to before 7.2.2-72806-57.3 to 7.3.1-86003-1

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Synology DiskStation Manager's single sign-on functionality, potentially allowing unauthenticated attackers to bypass login if they possess specific prior knowledge. This flaw could expose sensitive information or allow unauthorized access to systems.

Authentication bypass without credentials.
Affects remote access to storage and applications.
Confirm relevance and identify exposed systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests over the network to a Synology DiskStation Manager. If the system is vulnerable, the attacker could bypass the authentication system, gaining unauthorized access to protected resources. This bypass is possible due to an improper check of unusual conditions within the single sign-on (SSO) functionality.

Network access required.
Bypass authentication via SSO.
Unauthorized access to resources.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow remote attackers to bypass authentication for Synology DiskStation Manager when prior knowledge of a distinguished name is available. This could lead to unauthorized access to system data and services.

System and user data could be accessed.
Authentication bypass through network access.
Unauthorized access to services and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Synology DiskStation Manager (DSM) SSO authentication bypass requires immediate attention from teams responsible for identity and access management, as well as those overseeing storage and network infrastructure. The first practical step is to inventory all DSM instances, confirm their internet reachability and business criticality, and identify the accountable owner. Remediation planning should then be prioritized based on this risk assessment.

Own the issue: Identity and Infrastructure teams.
Verify first: Internet-facing DSM instances.
Action: Plan and execute targeted upgrades.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Synology DiskStation Manager (DSM)?

Synology DiskStation Manager is the operating system that powers Synology NAS devices. It provides a browser-based interface for managing storage, data backups, and various applications. Users rely on it as a centralized hub to store files and host services, often accessing these resources remotely over a network.

What does CVE-2025-13392 mean in plain English?

This is an authentication bypass vulnerability, classified as CWE-754 for improper checks of exceptional conditions. It means the software's Single Sign-On (SSO) process fails to correctly validate certain inputs. As a result, if an attacker knows a specific distinguished name (DN) used by the system, they can trick the software into granting them access without providing valid credentials.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted request to the Synology DSM device over the network. The vulnerability requires the attacker to have prior knowledge of a specific distinguished name. Importantly, this issue does not affect systems running version 7.2.1-69057, as that version does not contain the flawed SSO logic present in the affected release branches.

Is my Synology device relevant to this threat?

Your risk depends on your configuration and exposure. According to Halo Surface Signal, Synology DSM is often deployed as an internet-facing portal, making its SSO mechanism highly reachable. If your device is accessible directly from the internet, it is at higher risk. Internal systems may be less exposed, but you should still assess whether your DSM version falls within the affected ranges.

How should I respond to this vulnerability?

Begin by inventorying all DSM instances in your environment to identify which are affected and which are reachable via the internet. Determine the business criticality of each instance and confirm the responsible owner. Once you have a clear map of your assets, prioritize upgrading those that are internet-facing to the patched versions specified in the advisory.

References

www.synology.com/en-global/security/advisory/Synology_SA_25_14

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.