This vulnerability in Synology DSM arises from insufficient entropy in the login logic, impacting versions prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. Exploitation enables remote attackers to read or write arbitrary files and conduct denial-of-service attacks. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to full compromise of confidentiality, integrity, and availability of affected DSM systems by allowing remote attackers to read or write arbitrary files and cause denial-of-service conditions.

A fix is available in Synology DSM versions 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigation guidance is provided in the input data.