Live › vulnerability › CVE-2025-62839
QNAP Hybrid Backup Sync (HBS 3 and Hybrid Backup Sync) contains a hard-coded cryptographic key. A remote attacker who knows or extracts that key can compromise the security of the affected system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 08:23 UTC. All times on this page are UTC.
Teams running QNAP NAS devices with the HBS 3 or Hybrid Backup Sync app installed are exposed. Systems without these apps installed, or running the fixed versions, are not affected by this flaw.
No product ranges from the sources yet.
26.4.0.521 and later26.4.0.521 and later, or 26.4.1.563 and laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.
We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.1.563 and later
This page as .md · .json · in your agent: get_signal("CVE-2025-62839")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.