CVE-2025-62841

EUVD-2025-211209
An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.

We have already fixed the vulnerability in the following version:
HBS 3 Hybrid Backup Sync 26.4.0.521 and later
Hybrid Backup Sync 26.4.0.521 and later
Hybrid Backup Sync 26.4.1.563 and later
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
qnapCNA
8.7 HIGH
ADJACENT
LOW
NONE
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Base Score
CVSS 3.x
EPSS Score
Percentile: 15.79%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
qnaphybrid_backup_sync
26.4.0 ≤
𝑥
< 26.4.0.521
CNA
qnaphybrid_backup_sync
26.4.0 ≤
𝑥
< 26.4.1.563
CNA
Common Weakness Enumeration
References
https://www.qnap.com/en/app-release-notes?keyword=HBS%203&app=HybridBackup&product-line=nas
https://www.qnap.com/en/app-release-notes?keyword=Hybrid&app=HybridBackup&product-line=nas