Man-in-the-Middle Attack on Synology Active Backup for Business Lets Hackers Access User Credentials
CVE-2023-52950

5.3MEDIUM

Key Information:

Vendor

Synology
Status
Synology Active Backup For Business Agent
Vendor
CVE Published:
26 September 2024

What is CVE-2023-52950?

Missing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows adjacent man-in-the-middle attackers to obtain user credential via unspecified vectors.

Affected Version(s)

Synology Active Backup for Business Agent *

References

https://www.synology.com/en-global/security/advisory/Syno...
vendor-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zhao Runzi (赵润梓)
.