A critical SQL injection vulnerability in Synology Active Backup for Business allows unauthenticated remote attackers to perform unauthorized file reads, posing a significant risk to data confidentiality.

The application is susceptible to SQL injection (CWE-89) within its database interactions. This flaw allows an unauthenticated attacker to inject malicious SQL commands, resulting in the unauthorized extraction of arbitrary files from the host system.

This vulnerability carries a CVSS score of 8.6, reflecting the high risk posed by unauthenticated remote access to system files. Successful exploitation could lead to the exposure of sensitive configuration files, credentials, or proprietary data, resulting in severe data breaches and potential loss of intellectual property.

Immediate Action: Update Synology Active Backup for Business to version 2.7.1-3234 (or higher appropriate branch) as specified in the vendor security advisory.

Proactive Monitoring: Review system access logs for unusual SQL query patterns or unexpected file access requests originating from unauthorized network segments.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block common SQL injection patterns targeting the backup management interface.

Public Exploit Available: Unknown.

Given the high severity and the potential for unauthenticated access to sensitive files, administrators must prioritize patching this vulnerability immediately. Ensure that the Synology environment is updated to the latest secure version to prevent potential exploitation.