A critical vulnerability in Synology DiskStation Manager allows unauthenticated remote attackers to bypass security controls and gain unauthorized file access or disrupt system availability.

The software suffers from insufficient entropy (CWE-331) within its login logic, which permits an unauthenticated attacker to manipulate authentication processes and achieve unauthorized file system access.

The ability for an unauthenticated attacker to read or write arbitrary files on a network-attached storage device presents a severe risk to data confidentiality, integrity, and availability. With a CVSS score of 9.8, this vulnerability is classified as critical, as it provides a pathway for full system compromise, sensitive data exfiltration, or the deployment of malicious payloads that could lead to total loss of business operations.

Immediate Action: Update all affected Synology DSM instances to versions 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, or 7.2.1-69057-12 immediately.

Proactive Monitoring: Review system access logs for anomalous login attempts or unexpected file modification events originating from unknown IP addresses.

Compensating Controls: Implement strict network segmentation and restrict management interface access to trusted internal IP ranges via a firewall to reduce the attack surface.

Public Exploit Available: Unknown

Given the critical severity and the potential for full system compromise, administrators must prioritize patching this vulnerability across all exposed Synology devices. Ensure that firmware updates are applied immediately and verify that the management interface is not exposed to the public internet.