Active Backup Agent CVE-2025-66592

Exploitation requires the attacker to have local access to the target endpoint (AV:L). The attack window is specifically scoped to when the Synology Active Backup for Business Agent installation is actively running (UI:R - user interaction in the form of the installation process is required). No prior privileges are required by the attacker on the local system (PR:N). Exploitation is limited by: (1) the narrow time window of active installation, (2) local-only access - remote exploitation is not possible per the CVSS vector, and (3) restricted content writes - the attacker can influence file writes but content appears constrained, limiting full code execution. The 'Information Disclosure' tag conflicts with the C:N CVSS impact - defenders should treat confidentiality impact as unconfirmed until the vendor advisory is reviewed directly.

Real-world risk is moderate-to-low. The CVSS base score of 6.1 is somewhat inflated by the A:H component but is substantially constrained by AV:L (local access only) and UI:R (installation must be active). EPSS at 0.00% (0th percentile) and SSVC exploitation status of 'none' confirm no observed exploitation. The SSVC automatable flag is 'no', meaning mass exploitation is not feasible. KEV status is absent, reinforcing this is not an actively targeted vulnerability. One notable discrepancy: the advisory tags include 'Information Disclosure' yet the CVSS vector shows C:N (no confidentiality impact) - this suggests either the tag is a mis-categorization or a secondary confidentiality risk exists that is not reflected in the base score; defenders should verify with the vendor advisory at Synology_SA_25_16. Overall, this vulnerability is a genuine but low-urgency issue relevant only during installation windows on already-compromised or locally accessible systems.

A local attacker on a Windows or Linux endpoint - such as a low-privileged user in a shared environment - waits for or social-engineers an administrator to run the Synology Active Backup for Business Agent installer. During the installation process, the attacker exploits the origin validation failure to inject or substitute content into files the installer writes, potentially overwriting critical files or corrupting the agent installation to cause a denial of service. No public proof-of-concept exploit code has been identified at time of analysis.