Brief Summary: CVE-2025-13392 — Synology DSM SSO Authentication Bypass via SAML Flow - ZeroPath Blog

Introduction

An authentication bypass in the Single Sign-On implementation of Synology DiskStation Manager, proven at PWN2OWN, lets remote attackers fully compromise NAS devices through a flawed SAML authentication path. The attacker needs only prior knowledge of a valid LDAP Distinguished Name. Synology reports over 13 million installations worldwide across home and enterprise environments, and NAS devices routinely store an organization's most sensitive data, so this flaw puts a very large installed base at meaningful risk.

Synology's DiskStation Manager (DSM) is the web-based operating system that powers all Synology NAS appliances, including the DiskStation, FlashStation, and RackStation product lines. Synology is widely considered the dominant consumer and SMB NAS vendor globally. It holds a 4.9-star rating on Gartner Peer Insights, and its main competitor is QNAP, in a market where North America alone held a 41.40% share in 2025.

Technical Information

Root Cause: CWE-754 in the SAML Authentication Handler

CVE-2025-13392 is classified under CWE-754: Improper Check for Unusual or Exceptional Conditions. The flaw is in the SYNOPAMSSO::samlAuth method of DSM's SSO module. According to the Zero Day Initiative advisory (ZDI-25-1040), the core issue is that the software "permits authentication via a mechanism that should be disabled."

The DSM SSO module keeps a SAML authentication code path that should be inactive or restricted under certain conditions. The samlAuth method does not properly validate the authentication state when an exceptional condition arises, namely a SAML authentication request that arrives through this path carrying a known LDAP Distinguished Name (DN). The code implicitly trusts such requests instead of rejecting or scrutinizing them, which opens an alternate authentication channel around normal credential verification.

The root cause is also closely related to CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and CWE-289 (Authentication Bypass by Alternate Name), because exploitation means presenting a known DN through an authentication path that should not be available. The CAPEC mapping is CAPEC-115 (Authentication Bypass).

CVSS Breakdown

The CVSS v3.1 base score is 8.1 (High), with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The metrics break down as follows:

Metric	Value	Interpretation
Attack Vector	Network	Exploitable remotely over the network
Attack Complexity	High	Requires prior knowledge of a valid DN
Privileges Required	None	No authentication needed to initiate the attack
User Interaction	None	No user action required
Scope	Unchanged	Impact limited to the vulnerable component
Confidentiality	High	Full access to all NAS data
Integrity	High	Full modification capability over NAS data and configuration
Availability	High	Full disruption of NAS services possible

Attack Complexity is rated High because the attacker must already know a valid Distinguished Name. In LDAP/SSO contexts, a DN uniquely identifies an entity in a directory structure (for example, cn=admin,ou=users,dc=synology,dc=com). An attacker could obtain one through LDAP enumeration, information leakage, social engineering, or reconnaissance against directory services.

Attack Flow

Based on the ZDI advisory and Synology's own disclosure, exploitation runs in four steps:

Reconnaissance: The attacker obtains a valid Distinguished Name (DN) for a user or administrator account on the target Synology NAS. It could come from LDAP enumeration, information disclosure vulnerabilities, leaked directory data, or knowledge of the organization's directory structure.
SAML Request Crafting: The attacker builds a SAML authentication request containing the known DN and sends it to the DSM SSO endpoint, targeting the SYNOPAMSSO::samlAuth method.
Bypass via Alternate Path: The samlAuth method processes the crafted request through the improperly enabled authentication mechanism. The code does not check for the exceptional condition of authentication arriving through this path, which should be disabled, so it accepts the request.
Authenticated Access: The attacker gains authenticated access to the NAS without valid credentials. Depending on the DN used, this could grant administrative control over stored data, system configurations, installed packages, and network settings.

The ZDI advisory describes the attack vector as "network adjacent," meaning the attacker must be able to reach the DSM web interface. In many deployments, DSM is reachable on the local network through ports 5000 (HTTP) and 5001 (HTTPS). Where a misconfiguration exposes DSM to the internet, the attack surface grows considerably.

PWN2OWN Berlin 2025 Demonstration

Security researchers Le Trong Phuc (chanze@VRC) and Cao Ngoc Quy (Chino Kafuu) discovered and demonstrated this vulnerability at the PWN2OWN Berlin 2025 hacking competition. The submission was tracked as ZDI-CAN-28409 and published as ZDI-25-1040 on December 3, 2025. The target device was a Synology DiskStation DS925+. Researchers demonstrated 28 unique zero days across multiple categories at the competition, and the Synology DSM vulnerability fell under the NAS/enterprise storage target category.

Broader SAML Authentication Bypass Trend

CVE-2025-13392 fits a well-documented pattern of SAML/SSO authentication bypass vulnerabilities across the industry. Similar flaws have turned up in Fortinet products (CVE-2026-24858, FortiCloud SSO bypass), GitHub Enterprise (SAML bypass via parser differentials), and GitLab (Ruby SAML bypass). PortSwigger's research paper "The Fragile Lock" showed how parser-level differentials in SAML implementations can enable full authentication bypass. The common thread is that SAML implementations frequently fail to properly validate exceptional conditions in the authentication flow, which leaves alternate paths open to attackers.

Patch Information

Synology fixed CVE-2025-13392 in firmware under security advisory Synology-SA-25:14, first published on November 19, 2025, and most recently updated on May 27, 2026. The advisory's status is Resolved.

The fix corrects the validation logic in the SYNOPAMSSO::samlAuth method, so authentication requests arriving through the previously permissive SAML mechanism are properly scrutinized instead of implicitly trusted. Synology has not published a source-level diff, since DSM is proprietary firmware. The CWE-754 classification indicates that the patch adds stricter checks for conditions the original code either ignored or handled too permissively in the SSO/SAML pathway.

The patched firmware versions are:

DSM Branch	Fixed Version
DSM 7.3	7.3.1-86003-1 or above
DSM 7.2.2	7.2.2-72806-5 or above
DSM 7.2.1	Not affected (build 69057)

Synology explicitly lists DSM 7.2.1 (build 69057) as not affected. That suggests the vulnerable SAML SSO code was introduced or modified between the 7.2.1 and 7.2.2 branches, and that the patches in 7.2.2-72806-5 and 7.3.1-86003-1 fix this regression. Both patched firmware images are publicly available from Synology's archive site, and you can apply them through the standard DSM update mechanism (Package Center or the DSM Update page).

Synology's advisory explicitly states that no workaround exists for this vulnerability, so patching is the only remediation.

Detection Methods

At the time of writing, no publicly available Sigma rules, YARA rules, or Snort/Suricata signatures specifically target CVE-2025-13392 exploitation. Defenders still have several practical ways to find vulnerable systems and watch for suspicious activity.

Version-Based Vulnerability Scanning (OpenVAS)

The most concrete publicly documented detection mechanism is a remote version check in the OpenVAS scan engine. Pentest-Tools.com cataloged it as "Synology DiskStation Manager (DSM) Authentication Bypass Vulnerability (Synology-SA-25:14) — Remote Known Vulnerable Versions Check," with detection added on November 25, 2025. The check remotely fingerprints exposed DSM instances and compares their reported version against the known vulnerable range. If you run OpenVAS or Greenbone Vulnerability Management (GVM), make sure your NVT feed is current so it includes this detection plugin.

Behavioral and Log-Based Monitoring

No vendor has published log correlation rules or SIEM detection content, but the technical details in ZDI-25-1040 and Synology's advisory give defenders enough context to build targeted monitoring. These behavioral signals in DSM authentication logs warrant attention:

Successful authentications through the SSO/SAML pathway on DSM instances where SSO is not actively configured or expected to be in use. These could indicate exploitation.
Logins that succeed through the SAML authentication flow without a corresponding Identity Provider (IdP) redirect or assertion exchange. These may signal an attacker using this flaw.
Authentication attempts that reference unusual or unexpected DN values, or that cycle through multiple DNs. Exploitation requires knowledge of a valid DN, so cycling patterns could indicate enumeration activity.
Authentication attempts from unexpected network segments or non-standard source IPs within the local network. Both ZDI and Synology describe this flaw as exploitable by network-adjacent attackers without credentials, which makes these attempts particularly relevant.

Asset Discovery and Exposure Assessment

Since no exploit-level detection signatures exist, identifying every exposed Synology DSM instance in your environment is a critical defensive step alongside patching. Defenders should use asset inventory tools or network scanners to enumerate DSM web interfaces (typically on ports 5000/HTTP and 5001/HTTPS) and check whether any run a vulnerable DSM version.

Affected Systems and Versions

The vulnerability affects the following Synology DiskStation Manager versions:

Product	Vulnerable Versions	Fixed Version	Status
DSM 7.3	All versions before 7.3.1-86003-1	7.3.1-86003-1 or above	Patched
DSM 7.2.2	All versions before 7.2.2-72806-5	7.2.2-72806-5 or above	Patched
DSM 7.2.1	7.2.1-69057	N/A	Not affected

The PWN2OWN demonstration targeted a Synology DiskStation DS925+ running a vulnerable DSM version. Because DSM is the common operating system across all Synology hardware platforms, the vulnerability is present in any Synology NAS appliance (DiskStation, FlashStation, RackStation) running the affected DSM versions.

The explicit exclusion of DSM 7.2.1 indicates that the vulnerable samlAuth alternate path was introduced with changes in the 7.2.2 code branch.

Vendor Security History

Synology has been a PWN2OWN target in consecutive years:

Year	Advisory	ZDI Identifiers	Vulnerability Type
2024	Synology-SA-24:20	ZDI-CAN-25403, ZDI-CAN-25613	Remote code execution
2025	Synology-SA-25:14	ZDI-CAN-28409	SSO authentication bypass

Repeated PWN2OWN exploits against DSM suggest that its authentication and SSO subsystems have been a consistent weak spot in the product line. Outside PWN2OWN, Synology has fixed CVEs across multiple DSM versions, including BlueBorne (CVE-2017-1000250, CVE-2017-1000251) and vulnerabilities in libsoup, FFmpeg, cURL, and netatalk.

Synology is a CVE Numbering Authority (CNA) and follows a coordinated disclosure policy. The company states: "To protect users, we do not publicly announce security vulnerabilities until fixes are publicly available, nor are the exact details of such vulnerabilities." For CVE-2025-13392, Synology first published the advisory on November 19, 2025, and disclosed full vulnerability details on May 27, 2026. That roughly six-month coordinated disclosure timeline is consistent with the PWN2OWN responsible disclosure process.

Brief Summary: CVE-2025-13392 — Synology DSM SSO Authentication Bypass via SAML Flow

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical Information