Active Backup for Business EUVD-2025-209961

No special conditions for the network path - per CVSS AV:N/AC:L/PR:N/UI:N this is remote, unauthenticated, low-complexity exploitation requiring no user interaction against affected versions of Active Backup for Business. The practical prerequisites that limit exploitation are deployment-specific: the Active Backup for Business package must be installed on the Synology NAS and its service must be network-reachable by the attacker (e.g., an internet-exposed or otherwise routable DSM appliance), and the appliance must be running a version below the 2.7.1 fixed builds. Appliances where the backup service is firewalled off, reachable only over VPN/management network, or already updated are not exposed via this vector.

Signals here conflict and should be weighed deliberately. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a trivially reachable, unauthenticated, no-interaction network attack, and the 8.6 base score plus changed scope push it into 'high' territory. However, the exploitation-likelihood signals are low: EPSS is 0.04% (14th percentile), SSVC records exploitation status as 'none', KEV does not list it, and no public exploit code is identified at time of analysis. SSVC does flag the issue as 'automatable: yes' with 'partial' technical impact, meaning that if an exploit emerged it could be scripted at scale, but as of now there is no evidence of weaponization. One notable cross-reference worth verifying: the weakness is CWE-89 (SQL injection), yet the realized impact is described as arbitrary file read with no integrity or availability impact - an atypical SQLi outcome (SQLi more commonly enables data modification), so defenders should confirm with the Synology advisory exactly which data and files are exposed. Overall this is a real patch-soon priority for internet-exposed NAS appliances, but not an emergency given the absence of active exploitation or POC.

An attacker who can reach an exposed Active Backup for Business instance sends a crafted request carrying a SQL injection payload, manipulating a backend query to return the contents of arbitrary files on the appliance - for example backup configuration, credentials, or other sensitive DSM files. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low, the request can be issued directly against an internet-facing NAS; no public exploit code is identified at time of analysis, so an attacker would currently need to develop their own.