Synology Vulnerabilities and Affected Products
Vulnerabilities associated with Synology Active Backup for Business Agent.
Products
Clear product- DiskStation Manager (DSM)53 vulnerabilities
- Synology Router Manager (SRM)43 vulnerabilities
- Surveillance Station25 vulnerabilities
- Synology Photo Station18 vulnerabilities
- Synology DiskStation Manager (DSM)13 vulnerabilities
- Photo Station12 vulnerabilities
- Camera Firmware9 vulnerabilities
- Drive7 vulnerabilities
- BeeDrive for desktop6 vulnerabilities
- Calendar6 vulnerabilities
- camera_firmware6 vulnerabilities
- router_manager6 vulnerabilities
- Synology Drive Client6 vulnerabilities
- Unified Controller (DSMUC)6 vulnerabilities
- Media Server5 vulnerabilities
- Synology Active Backup for Business Agent5 vulnerabilities
- Synology Calendar5 vulnerabilities
- Active Backup for Business4 vulnerabilities
- Note Station4 vulnerabilities
- active_backup_for_business_agent3 vulnerabilities
- Audio Station3 vulnerabilities
- BeeStation OS (BSM)3 vulnerabilities
- Download Station3 vulnerabilities
- Safe Access3 vulnerabilities
- Synology Download Station3 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-66592MEDIUM | Generated title:Synology Active Backup for Business Agent Origin Validation Error Arbitrary File Write and Denial of ServiceAn origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation. CWE-346May 27, 2026 | CVSS6.1v3.1 | EPSS0.086% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-52949MEDIUM | Missing authentication for critical function vulnerability in proxy settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users to obtain user credential via unspecified vectors. CWE-306Sep 26, 2024 | CVSS5.5v3.1 | EPSS0.176% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-52948MEDIUM | Missing encryption of sensitive data vulnerability in settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users to obtain user credential via unspecified vectors. CWE-311Sep 26, 2024 | CVSS5.0v3.1 | EPSS0.085% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-52947MEDIUM | Missing authentication for critical function vulnerability in logout functionality in Synology Active Backup for Business Agent before 2.6.3-3101 allows local users to logout the client via unspecified vectors. The backup functionality will continue to operate and will not be affected by the logout. CWE-306Sep 26, 2024 | CVSS4.0v3.1 | EPSS0.164% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-52950MEDIUM | Missing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows adjacent man-in-the-middle attackers to obtain user credential via unspecified vectors. CWE-311Sep 26, 2024 | CVSS5.3v3.1 | EPSS0.08% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |