Refine your search

2 vulnerabilities found for Hybrid Backup Sync by QNAP Systems Inc.

CVE-2025-62841 (GCVE-0-2025-62841)
Vulnerability from cvelistv5
Published
2026-10-29 07:40
Modified
2026-10-29 07:40
Severity ?
8.7 (High) - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE
Summary
An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.1.563 and later
References
Impacted products
Vendor Product Version
QNAP Systems Inc. HBS 3 Hybrid Backup Sync Version: 26.4.x   < 26.4.0.521
 Create a notification for this product.
   QNAP Systems Inc. Hybrid Backup Sync Version: 26.4.x   < 26.4.0.521
Version: 26.4.x   < 26.4.1.563
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "HBS 3 Hybrid Backup Sync",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "26.4.0.521",
              "status": "affected",
              "version": "26.4.x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Hybrid Backup Sync",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "26.4.0.521",
              "status": "affected",
              "version": "26.4.x",
              "versionType": "custom"
            },
            {
              "lessThan": "26.4.1.563",
              "status": "affected",
              "version": "26.4.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Team DDOS"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following version:\u003cbr\u003eHBS 3 Hybrid Backup Sync 26.4.0.521 and later\u003cbr\u003eHybrid Backup Sync 26.4.0.521 and later\u003cbr\u003eHybrid Backup Sync 26.4.1.563 and later"
            }
          ],
          "value": "An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nHBS 3 Hybrid Backup Sync 26.4.0.521 and later\nHybrid Backup Sync 26.4.0.521 and later\nHybrid Backup Sync 26.4.1.563 and later"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-191",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-191"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-321",
              "description": "CWE-321",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T07:40:02.766Z",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://www.qnap.com/en/app-release-notes?keyword=HBS%203\u0026app=HybridBackup\u0026product-line=nas"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://www.qnap.com/en/app-release-notes?keyword=Hybrid\u0026app=HybridBackup\u0026product-line=nas"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "We have already fixed the vulnerability in the following version:\u003cbr\u003eHBS 3 Hybrid Backup Sync 26.4.0.521 and later\u003cbr\u003eHybrid Backup Sync 26.4.0.521 and later\u003cbr\u003eHybrid Backup Sync 26.4.1.563 and later"
            }
          ],
          "value": "We have already fixed the vulnerability in the following version:\nHBS 3 Hybrid Backup Sync 26.4.0.521 and later\nHybrid Backup Sync 26.4.0.521 and later\nHybrid Backup Sync 26.4.1.563 and later"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Hard-coded Cryptographic Key #2",
      "x_generator": {
        "engine": "QNAP PSIRT cve_tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2025-62841",
    "datePublished": "2026-10-29T07:40:02.766Z",
    "dateReserved": "2025-10-24T02:43:45.372Z",
    "dateUpdated": "2026-10-29T07:40:02.766Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-62839 (GCVE-0-2025-62839)
Vulnerability from cvelistv5
Published
2026-10-29 07:39
Modified
2026-10-29 07:39
Severity ?
8.7 (High) - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE
Summary
An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.1.563 and later
References
Impacted products
Vendor Product Version
QNAP Systems Inc. HBS 3 Hybrid Backup Sync Version: 26.4.x   < 26.4.0.521
 Create a notification for this product.
   QNAP Systems Inc. Hybrid Backup Sync Version: 26.4.x   < 26.4.0.521
Version: 26.4.x   < 26.4.1.563
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "HBS 3 Hybrid Backup Sync",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "26.4.0.521",
              "status": "affected",
              "version": "26.4.x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Hybrid Backup Sync",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "26.4.0.521",
              "status": "affected",
              "version": "26.4.x",
              "versionType": "custom"
            },
            {
              "lessThan": "26.4.1.563",
              "status": "affected",
              "version": "26.4.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Team DDOS"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following version:\u003cbr\u003eHBS 3 Hybrid Backup Sync 26.4.0.521 and later\u003cbr\u003eHybrid Backup Sync 26.4.0.521 and later\u003cbr\u003eHybrid Backup Sync 26.4.1.563 and later"
            }
          ],
          "value": "An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nHBS 3 Hybrid Backup Sync 26.4.0.521 and later\nHybrid Backup Sync 26.4.0.521 and later\nHybrid Backup Sync 26.4.1.563 and later"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-191",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-191"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-321",
              "description": "CWE-321",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T07:39:53.736Z",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://www.qnap.com/en/app-release-notes?keyword=HBS%203\u0026app=HybridBackup\u0026product-line=nas"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://www.qnap.com/en/app-release-notes?keyword=Hybrid\u0026app=HybridBackup\u0026product-line=nas"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "We have already fixed the vulnerability in the following version:\u003cbr\u003eHBS 3 Hybrid Backup Sync 26.4.0.521 and later\u003cbr\u003eHybrid Backup Sync 26.4.0.521 and later\u003cbr\u003eHybrid Backup Sync 26.4.1.563 and later"
            }
          ],
          "value": "We have already fixed the vulnerability in the following version:\nHBS 3 Hybrid Backup Sync 26.4.0.521 and later\nHybrid Backup Sync 26.4.0.521 and later\nHybrid Backup Sync 26.4.1.563 and later"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Hard-coded Cryptographic Key #1",
      "x_generator": {
        "engine": "QNAP PSIRT cve_tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2025-62839",
    "datePublished": "2026-10-29T07:39:53.736Z",
    "dateReserved": "2025-10-24T02:43:45.371Z",
    "dateUpdated": "2026-10-29T07:39:53.736Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}