PT-2025-21627 · Synology · Synology Active Backup For Microsoft 365

Leonid Hartmann + 1 · Published 2025-05-16 · Updated 2025-08-04 · CVE-2025-4679

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Synology Active Backup for Microsoft 365 (affected versions not specified)

Description: A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors. This issue could allow malicious actors to access sensitive data in Microsoft 365 tenants that have authorized the Active Backup for Microsoft 365 enterprise app. The exact period for which this flaw existed is unknown, but it was fixed by Synology after disclosure. Inspecting the setup process of any Synology Active Backup for Microsoft 365 install could give an attacker the master key to all M365 tenants that had authorized the app.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2025-10543

CVE-2025-4679

Affected Products

Synology Active Backup For Microsoft 365

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2025-4679 · Security Note
• https://synology.com/en-global/security/advisory/Synology_SA_25_06 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10543 · Security Note
• https://twitter.com/Komodosec/status/1952493391167856986 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1939511074690302057 · Twitter Post
• https://modzero.com/static/MZ-25-02_modzero_Synology-Active-Backup-M365.pdf · Note
• https://twitter.com/fridaysecurity/status/1939479157181653132 · Twitter Post
• https://t.me/cvetracker/24008 · Telegram Post
• https://t.me/true_secator/7191 · Telegram Post
• https://reddit.com/r/msp/comments/1lm3z1e/flaw_in_synology_active_backup_for_microsoft_365 · Reddit Post
• https://reddit.com/r/sysadmin/comments/1lm42v7/flaw_in_synology_active_backup_for_microsoft_365 · Reddit Post
• https://t.me/cvenotify/124197 · Telegram Post
• https://twitter.com/lukasberancz/status/1941815020603465798 · Twitter Post
• https://t.me/cvenotify/122500 · Telegram Post
• https://modzero.com/en/blog/when-backups-open-backdoors-synology-active-backup-m365 · Note