CVE-2025-13392 is an authentication bypass vulnerability in Synology DiskStation Manager's SSO component due to improper validation of unusual or exceptional conditions. Remote attackers who know a valid distinguished name (DN) can exploit this flaw to bypass authentication controls. The issue affects DSM versions prior to 7.2.2-72806-5 and 7.3.1-86003-1, except version 7.2.1-69057. The vulnerability has a CVSS 3.1 score of 8.1, reflecting high impact across confidentiality, integrity, and availability. As of the provided data, no official patch or vendor advisory confirming remediation is available, and no exploits have been observed in the wild.

Successful exploitation allows remote attackers to bypass authentication on affected Synology DSM versions, potentially leading to full system compromise including unauthorized access to sensitive data and administrative functions. The vulnerability impacts confidentiality, integrity, and availability of the system. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to DSM management interfaces and monitor for suspicious activity related to authentication bypass attempts. Avoid exposing DSM services directly to untrusted networks.