CVE-2025-66592

Vulnerability

An origin validation error (CWE-346) exists in Synology Active Backup for Business Agent for Windows prior to version 3.1.0-4967 [1]. During the installation process, the agent fails to properly verify the origin of certain operations, enabling a local user to write arbitrary files, albeit with restricted content, onto the system [1].

Exploitation

An attacker must have local access to the system where the agent is being installed, but does not require any prior authentication [1]. The vulnerability is triggered without user interaction (UI:R, so low interaction required) [1]. By manipulating the installation flow, the attacker can redirect or inject content to achieve file writes beyond the intended installation paths [1].

Impact

Successful exploitation allows the attacker to write arbitrary files with restricted content to arbitrary locations on the system [1]. This can lead to partial integrity compromise (CVSS I:L) and can cause a high availability impact (CVSS A:H) if the written files disrupt system operations or overwrite critical system components [1]. Confidentiality is not directly affected (CVSS C:N) [1].

Mitigation

Synology released fixed version 3.1.0-4967 of Active Backup for Business Agent for Windows [1]. Users should upgrade to this version or above. No workaround is available [1]. The CVE is not listed in the known exploited vulnerabilities (KEV) catalog.