What is CVE-2025-1021?

CVE-2025-1021 is a high-severity vulnerability in Synology Diskstation Manager (Dsm), classified under Missing Authorization. CVSS score: 7.5/10. Published 2025-04-23.

How severe is CVE-2025-1021?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Synology Diskstation Manager (Dsm)

CVE-2025-1021

Missing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows remote attackers to read arbitrary files via unspecified vectors.

Vulnerability class: Broken Access Control

EPSS: 0.002 (37.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Synology Diskstation Manager (Dsm) — versions 7.2.2, 7.2.1, 7.1

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

Synology-SA-25:03 DSM (vendor-advisory)

Frequently asked questions

What is CVE-2025-1021?: CVE-2025-1021 is a high-severity vulnerability in Synology Diskstation Manager (Dsm), classified under Missing Authorization. CVSS score: 7.5/10. Published 2025-04-23.
How severe is CVE-2025-1021?: High severity. CVSS v3 base score is 7.5 out of 10.