Thorsten Schröder

Name of the Vulnerable Software and Affected Versions: Synology Active Backup for Microsoft 365 (affected versions not specified) Description: A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors. This issue could allow malicious actors to access sensitive data in Microsoft 365 tenants that have authorized the Active Backup for Microsoft 365 enterprise app. The exact period for which this flaw existed is unknown, but it was fixed by Synology after disclosure. Inspecting the setup process of any Synology Active Backup for Microsoft 365 install could give an attacker the master key to all M365 tenants that had authorized the app. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CBR40 versions prior to 2.5.0.14 EX6100v2 versions prior to 1.0.1.98 EX6150v2 versions prior to 1.0.1.98 EX6250 versions prior to 1.0.0.132 EX6400 versions prior to 1.0.2.158 EX6400v2 versions prior to 1.0.0.132 EX6410 versions prior to 1.0.0.132 EX6420 versions prior to 1.0.0.132 EX7300 versions prior to 1.0.2.158 EX7300v2 versions prior to 1.0.0.132 EX7320 versions prior to 1.0.0.132 EX7700 versions prior to 1.0.0.216 EX8000 versions prior to 1.0.1.232 R7800 versions prior to 1.0.2.78 RBK12 versions prior to 2.6.1.44 RBR10 versions prior to 2.6.1.44 RBS10 versions prior to 2.6.1.44 RBK20 versions prior to 2.6.1.38 RBR20 versions prior to 2.6.1.36 RBS20 versions prior to 2.6.1.38 RBK40 versions prior to 2.6.1.38 RBR40 versions prior to 2.6.1.36 RBS40 versions prior to 2.6.1.38 RBK50 versions prior to 2.6.1.40 RBR50 versions prior to 2.6.1.40 RBS50 versions prior to 2.6.1.40 RBK752 versions prior to 3.2.16.6 RBR750 versions prior to 3.2.16.6 RBS750 versions prior to 3.2.16.6 RBK852 versions prior to 3.2.16.6 RBR850 versions prior to 3.2.16.6 RBS850 versions prior to 3.2.16.6 RBS40V versions prior to 2.6.2.4 RBS50Y versions prior to 2.6.1.40 RBW30 versions prior to 2.6.2.2 XR500 versions prior to 2.3.2.114 **Description** Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. **Recommendations** Update CBR40 to version 2.5.0.14 or later. Update EX6100v2 to version 1.0.1.98 or later. Update EX6150v2 to version 1.0.1.98 or later. Update EX6250 to version 1.0.0.132 or later. Update EX6400 to version 1.0.2.158 or later. Update EX6400v2 to version 1.0.0.132 or later. Update EX6410 to version 1.0.0.132 or later. Update EX6420 to version 1.0.0.132 or later. Update EX7300 to version 1.0.2.158 or later. Update EX7300v2 to version 1.0.0.132 or later. Update EX7320 to version 1.0.0.132 or later. Update EX7700 to version 1.0.0.216 or later. Update EX8000 to version 1.0.1.232 or later. Update R7800 to version 1.0.2.78 or later. Update RBK12 to version 2.6.1.44 or later. Update RBR10 to version 2.6.1.44 or later. Update RBS10 to version 2.6.1.44 or later. Update RBK20 to version 2.6.1.38 or later. Update RBR20 to version 2.6.1.36 or later. Update RBS20 to version 2.6.1.38 or later. Update RBK40 to version 2.6.1.38 or later. Update RBR40 to version 2.6.1.36 or later. Update RBS40 to version 2.6.1.38 or later. Update RBK50 to version 2.6.1.40 or later. Update RBR50 to version 2.6.1.40 or later. Update RBS50 to version 2.6.1.40 or later. Update RBK752 to version 3.2.16.6 or later. Update RBR750 to version 3.2.16.6 or later. Update RBS750 to version 3.2.16.6 or later. Update RBK852 to version 3.2.16.6 or later. Update RBR850 to version 3.2.16.6 or later. Update RBS850 to version 3.2.16.6 or later. Update RBS40V to version 2.6.2.4 or later. Update RBS50Y to version 2.6.1.40 or later. Update RBW30 to version 2.6.2.2 or later. Update XR500 to version 2.3.2.114 or later.