This vulnerability arises from improper permission settings on critical resources within the LDAP API of Synology DiskStation Manager (DSM). Remote authenticated users can exploit this flaw to gain unauthorized read/write access to arbitrary files and perform denial-of-service attacks. The affected DSM versions include those prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. Confidentiality, integrity, and availability impacts are all high.

Successful exploitation allows remote authenticated users to read or modify arbitrary files on the system and disrupt service availability through denial-of-service attacks. This can lead to significant confidentiality breaches, data integrity violations, and service outages on affected Synology DSM devices.

A fix is available in Synology DiskStation Manager versions 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigation guidance is provided in the vendor advisory; patching is the recommended action.