CVE-2025-13392 is a high severity (8.1) authentication bypass in the SSO feature of Synology DiskStation Manager. A remote attacker who knows a distinguished name can sign in. Upgrade to DSM 7.2.2-72806-5 or 7.3.1-86003-1 or later. DSM 7.2.1 is not affected.
What's affected
Synology advisory Synology_SA_25_14 lists these fixes.
- DSM 7.3: upgrade to 7.3.1-86003-1 or later.
- DSM 7.2.2: upgrade to 7.2.2-72806-5 or later.
- DSM 7.2.1: not affected.
The advisory rates the issue Important at CVSS 8.1 and lists no mitigation other than the upgrade. The record describes the cause as an improper check for unusual or exceptional conditions in SSO, and says an attacker needs prior knowledge of the distinguished name, which explains the high attack complexity in the vector.
How to check if you're exposed
Check the DSM version.
- Sign in to DSM and open Control Panel, then Info Center, and read the DSM version.
- Compare it to the fixed versions above.
- Check whether SSO, such as an LDAP or directory based login, is enabled.
- Check whether DSM is exposed to the internet through port forwarding or QuickConnect, and review sign in logs for logins that you do not recognize.
What to do now
- Upgrade DSM through Control Panel and Update and Restore to a fixed version for your release line.
- If you cannot update immediately, restrict access to DSM to your internal network or VPN.
- Review login logs and the user list for unfamiliar activity.
- Review shared folders and backups on the NAS for unexpected changes.
- Turn on automatic DSM update checks.
Why it matters
The weakness is CWE-754, improper check for unusual or exceptional conditions. An authentication path that handles an unexpected input in the wrong way can end with a successful login. Such errors tend to live in edge cases that normal testing does not cover.
A NAS often holds backups, documents and credentials, and an authentication bypass gives an attacker everything the target account can reach. The attacker needs to know a distinguished name, which in many directories follows a predictable pattern, so do not rely on that requirement as a defense.
Quick check
Is DSM 7.2.1 affected?
No. The Synology advisory states that DSM 7.2.1-69057 is not affected.
Sources
Last reviewed: 19 October 2026.
