CVE-2025-30028: Active Backup Information Disclosure Flaw

CVE-2025-30028 Overview

CVE-2025-30028 is a vulnerability in Synology Active Backup for Business that allows unauthorized remote attackers to read arbitrary files. The flaw is categorized under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command), indicating SQL injection as the underlying weakness used to access file contents. The vulnerability is network-reachable and requires no authentication or user interaction, with a scope change that extends impact beyond the vulnerable component. Refer to the Synology Security Advisory for vendor guidance.

Critical Impact
Unauthenticated remote attackers can read arbitrary files from systems running affected versions of Active Backup for Business, exposing backup data, credentials, and configuration secrets.

Affected Products

Synology Active Backup for Business (per vendor advisory)
Synology DSM hosts running the affected package
Backup repositories managed by the vulnerable service

Discovery Timeline

2026-05-27 - CVE-2025-30028 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2025-30028

Vulnerability Analysis

The vulnerability resides in Active Backup for Business, Synology's enterprise backup solution for physical servers, virtual machines, and file servers. The weakness classification [CWE-89] indicates that attacker-supplied input reaches a SQL query without proper neutralization. Attackers leverage the injection primitive to read arbitrary files from the underlying host. The attack proceeds across the network with no privileges and no user interaction, and the scope change reflects that data accessed extends beyond the vulnerable database component. Exposed files can include backup artifacts, application configuration, stored credentials, and operating system secrets.

Root Cause

The root cause is improper sanitization of user-controlled input passed into SQL statements within Active Backup for Business. The injection path enables file-read operations through database functions or query primitives that interact with the file system. Because the service is exposed to remote clients, the unsanitized query surface is reachable without authentication.

Attack Vector

A remote attacker sends a crafted request to the Active Backup for Business service over the network. The malicious payload manipulates the SQL query logic to trigger file content retrieval. Successful exploitation returns file contents in the response or via side-channel database state, depending on the specific injection technique used. No verified public proof-of-concept exploit code is currently available. See the Synology Security Advisory for technical details and fixed versions.

Detection Methods for CVE-2025-30028

Indicators of Compromise

Unexpected outbound responses from the Active Backup for Business service containing file contents such as /etc/passwd, /etc/shadow, or DSM configuration files.
Anomalous SQL query patterns in application logs containing union selects, LOAD_FILE, or boolean blind injection signatures.
Unauthenticated requests from external IP addresses to Active Backup for Business endpoints.
Spikes in error responses from the backup service correlated with reconnaissance scanning.

Detection Strategies

Inspect HTTP request bodies and query parameters reaching Active Backup for Business for SQL metacharacters and stacked-query syntax.
Correlate backup service access logs with firewall telemetry to identify external sources contacting internal-only services.
Baseline normal Active Backup for Business traffic volume and alert on deviations consistent with automated probing.

Monitoring Recommendations

Forward DSM and Active Backup for Business logs to a centralized analytics platform for retention and search.
Monitor file integrity on sensitive paths that may be targeted by arbitrary read primitives.
Track authentication and session telemetry on adjacent Synology services that may be pivoted to after data disclosure.

How to Mitigate CVE-2025-30028

Immediate Actions Required

Apply the fixed Active Backup for Business package version published in the Synology Security Advisory as soon as it is available for your DSM release.
Restrict network access to the backup service so only management subnets and authorized backup clients can reach it.
Rotate any credentials, API keys, or backup encryption material that may have been exposed through file reads.
Review backup service logs for evidence of pre-patch exploitation attempts.

Patch Information

Synology publishes fixed versions and remediation guidance in advisory Synology_SA_25_02. Administrators should consult the vendor advisory to identify the minimum fixed package version for their DSM platform and update Active Backup for Business through Package Center.

Workarounds

Block external access to Active Backup for Business ports at the perimeter firewall until the patch is applied.
Place the NAS behind a VPN and disallow direct internet exposure of backup management interfaces.
Disable the Active Backup for Business package on systems where it is not actively required.

bash

# Configuration example: restrict Active Backup for Business to a management subnet
# Replace 10.10.20.0/24 with your authorized backup management network
sudo iptables -A INPUT -p tcp --dport 5510 -s 10.10.20.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 5510 -j DROP