CVE-2025-13392: Synology DSM SSO Auth Bypass Vulnerability

CVE-2025-13392 Overview

CVE-2025-13392 is an authentication bypass vulnerability in the Single Sign-On (SSO) component of Synology DiskStation Manager (DSM). The flaw stems from an improper check for unusual or exceptional conditions [CWE-754] in how the SSO service validates authentication requests. Remote attackers with prior knowledge of a valid distinguished name (DN) can bypass authentication and access the system without supplying valid credentials. The vulnerability affects DSM versions before 7.2.2-72806-5 and 7.3.1-86003-1, while version 7.2.1-69057 is not affected.

Critical Impact

Remote attackers who know a valid distinguished name can bypass SSO authentication and gain unauthorized access to Synology DSM appliances, compromising confidentiality, integrity, and availability of stored data.

Affected Products

• Synology DiskStation Manager (DSM) versions before 7.2.2-72806-5
• Synology DiskStation Manager (DSM) versions before 7.3.1-86003-1
• Note: DSM version 7.2.1-69057 is not affected

Discovery Timeline

• 2026-05-27 - CVE CVE-2025-13392 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2025-13392

Vulnerability Analysis

The vulnerability resides in the SSO subsystem of Synology DSM. The SSO service handles federated authentication for users accessing DSM web interfaces and integrated services. An improper check for unusual or exceptional conditions allows the authentication flow to proceed when it should be rejected.

An attacker who knows the distinguished name (DN) of a valid directory user can submit a crafted authentication request. The SSO component fails to enforce the full set of validation conditions and accepts the request as authenticated. The result is a complete authentication bypass with the privileges associated with the supplied DN.

The attack is remote and requires no user interaction. Exploitation complexity is elevated because the attacker must first obtain a valid DN, which is typically discovered through reconnaissance against the target directory service. The EPSS score is 0.054%, reflecting limited observed exploitation activity at publication time.

Root Cause

The root cause is classified as CWE-754: Improper Check for Unusual or Exceptional Conditions. The SSO authentication routine does not correctly evaluate all conditions required to confirm a valid login. When specific exceptional inputs are supplied, the code path that should deny access instead returns a success state, granting an authenticated session tied to the supplied DN.

Attack Vector

The attack vector is network-based. An attacker reaches the DSM SSO endpoint over the network and submits authentication traffic containing a known DN. With prior knowledge of a valid DN, the attacker triggers the flawed exceptional-condition handling path. No credentials, tokens, or user interaction are required. Successful exploitation yields authenticated access to DSM resources associated with that identity.

For technical specifics, refer to the Synology Security Advisory SA-25-14.

Detection Methods for CVE-2025-13392

Indicators of Compromise

• Successful DSM SSO authentication events for accounts with no preceding credential prompt or token issuance in audit logs
• Authentication entries originating from external or unexpected IP ranges referencing internal directory DNs
• Session creation events on DSM without corresponding LDAP bind activity in directory server logs

Detection Strategies

• Correlate DSM SSO login events against directory authentication logs to identify sessions established without a matching bind operation
• Monitor DSM web administration endpoints for repeated authentication attempts that supply distinguished names in unusual encodings or formats
• Alert on first-time logins for service or administrative DNs from previously unseen network sources

Monitoring Recommendations

• Forward DSM system, connection, and SSO logs to a centralized logging or SIEM platform for retention and correlation
• Enable alerting on administrator-equivalent logins outside business hours or from non-corporate networks
• Track DSM software version inventory to confirm patched builds are deployed across all appliances

How to Mitigate CVE-2025-13392

Immediate Actions Required

• Upgrade Synology DSM to version 7.2.2-72806-5 or 7.3.1-86003-1 or later on all affected appliances
• Restrict DSM management and SSO endpoints to trusted networks using firewall rules or VPN access
• Audit existing DSM sessions and administrative accounts for unauthorized access since exposure began
• Rotate credentials for directory accounts integrated with DSM SSO, particularly privileged DNs

Patch Information

Synology has released fixed builds in DSM 7.2.2-72806-5 and 7.3.1-86003-1. DSM 7.2.1-69057 is explicitly listed as not affected. Administrators should consult the Synology Security Advisory SA-25-14 for full upgrade guidance and any prerequisite steps.

Workarounds

• Disable SSO functionality on DSM until the patched build is installed if the feature is not required
• Place DSM appliances behind a reverse proxy or VPN that enforces an additional authentication layer
• Limit exposure of the DSM web interface to the public internet through network segmentation and access control lists

# Example: restrict DSM management ports to trusted CIDR ranges at the network edge
# Replace 10.0.0.0/24 with your administrative network
iptables -A INPUT -p tcp --dport 5000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5001 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5000 -j DROP
iptables -A INPUT -p tcp --dport 5001 -j DROP