CVE-2025-13392
Synology Diskstation Manager 7.2.2 – 7.2.2-72806-5
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-13392 is a high-severity Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability in Synology Diskstation Manager. Its CVSS base score is 8.1 (High).
Operationally, ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209956
Vulnerability Data
Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge of the distinguished name (DN).
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation explicitly exercises unusual conditions to find missing or incorrect checks.
Input validation directly requires checking for unexpected or malformed conditions before they propagate.
Security engineering principles include structured handling of edge cases and exceptions during design.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Logging can record unhandled exceptions but does not prevent the weakness itself.
Monitoring may detect symptoms of unhandled conditions but does not eliminate the root weakness.
Secure development life cycle mandates exception handling and input validation that directly prevent missing checks for unusual conditions.
Application security requirements explicitly call for handling of exceptional conditions and error paths.
A.8.27 mandates security-by-design principles (fail securely, least privilege, distrust external input, security-oriented design reviews) that reach some but not most CWE-754 cases; many exceptional-condition checks live in low-level code paths outside architecture-level engineering.
Secure coding standards directly mandate proper checks for exceptional and unusual conditions.