The vulnerability involves an improper check for unusual or exceptional conditions in the single sign-on (SSO) flow of Synology DiskStation Manager. Attackers who already know a valid distinguished name (DN) can bypass authentication, granting them unauthorized access to the device's management interface. This leads to full compromise of confidentiality, integrity, and availability of the affected DSM installation.

Synology DiskStation Manager (DSM) versions prior to 7.2.2‑72806‑5 and 7.3.1‑86003‑1 are affected. The 7.2.1‑69057 release is not impacted. The issue resides in the SSO component of DSM.

The CVSS score of 8.1 indicates high severity, but the EPSS score is not available, suggesting limited data on current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, likely over the network via the SSO endpoints. Attackers require knowledge of a DN but no additional privileges. If exploited, the attacker would gain full administrative control of the DSM device.