{"id":"CVE-2025-62839","kind":"vulnerability","aliases":["CVE-2025-62839"],"related":[],"title":"QNAP Hybrid Backup Sync: hard-coded key lets remote attackers compromise the system","description":"An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nHBS 3 Hybrid Backup Sync 26.4.0.521 and later\nHybrid Backup Sync 26.4.0.521 and later\nHybrid Backup Sync 26.4.1.563 and later","summary":"QNAP Hybrid Backup Sync (HBS 3 and Hybrid Backup Sync) contains a hard-coded cryptographic key. A remote attacker who knows or extracts that key can compromise the security of the affected system.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hybrid-backup-sync","infrastructure","nas","qnap","self-hosted"],"not_affected_if":["app-not-installed","fixed-version"],"how_to_check":"- Check the installed Hybrid Backup Sync version in the QNAP App Center or Hybrid Backup Sync app.\n- Confirm whether the HBS 3 or Hybrid Backup Sync app is installed on the NAS at all.","fix":"- HBS 3 Hybrid Backup Sync: `26.4.0.521` and later\n- Hybrid Backup Sync: `26.4.0.521` and later, or `26.4.1.563` and later","status":"open","published_at":"2026-10-29T08:16:59+00:00","first_seen_at":"2026-10-29T08:23:43+00:00","triaged_at":"2026-10-29T08:24:19+00:00","updated_at":"2026-10-29T08:24:19+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-29T08:24:19Z","model":"claude-haiku-5-5","output":{"fix":"- HBS 3 Hybrid Backup Sync: `26.4.0.521` and later\n- Hybrid Backup Sync: `26.4.0.521` and later, or `26.4.1.563` and later","reach":"internet","title":"QNAP Hybrid Backup Sync: hard-coded key lets remote attackers compromise the system","impact":"high","summary":"QNAP Hybrid Backup Sync (HBS 3 and Hybrid Backup Sync) contains a hard-coded cryptographic key. A remote attacker who knows or extracts that key can compromise the security of the affected system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["qnap","nas","hybrid-backup-sync","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"remote attacker compromises the NAS backup system","analyst_note":"","how_to_check":"- Check the installed Hybrid Backup Sync version in the QNAP App Center or Hybrid Backup Sync app.\n- Confirm whether the HBS 3 or Hybrid Backup Sync app is installed on the NAS at all.","plain_action":"","needs_analyst":false,"not_affected_if":["app-not-installed","fixed-version"],"who_is_affected":"Teams running QNAP NAS devices with the HBS 3 or Hybrid Backup Sync app installed are exposed. Systems without these apps installed, or running the fixed versions, are not affected by this flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000705,"input_tokens":4215,"output_tokens":568,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2025':16A,19A '-62839':17A,20A '26.4.0.521':118C,124C '26.4.1.563':130C '3':36B,80C,114C 'affect':63B,78C 'allow':93C 'alreadi':105C 'attack':11A,50B,95C 'backup':3A,23B,33B,39B,82C,86C,116C,122C,128C 'code':7A,45B,70C 'compromis':12A,58B,97C 'contain':41B 'could':92C 'cryptograph':46B,71C 'cve':15A,18A 'exploit':89C 'extract':54B 'fix':106C 'follow':111C 'hard':6A,44B,69C 'hard-cod':5A,43B,68C 'hbs':35B,79C,113C 'host':30B 'hybrid':2A,22B,32B,38B,81C,85C,115C,121C,127C 'hybrid-backup-sync':21B 'infrastructur':25B 'key':8A,47B,56B,72C 'know':52B 'later':120C,126C,132C 'let':9A 'nas':26B 'qnap':1A,27B,31B 'remot':10A,49B,94C 'report':76C 'secur':60B,99C 'self':29B 'self-host':28B 'sync':4A,24B,34B,40B,83C,87C,117C,123C,129C 'system':14A,64B,102C 'use':66C 'version':112C 'vulner':73C,91C,108C","nicknames":[],"mitigations":[],"who_affected":"Teams running QNAP NAS devices with the HBS 3 or Hybrid Backup Sync app installed are exposed. Systems without these apps installed, or running the fixed versions, are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T08:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@qnapsecurity.com.tw","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-62839","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62839","severity":null,"published_at":"2026-10-29T08:16:59+00:00","modified_at":"2026-10-29T08:17:00+00:00","first_seen_at":"2026-10-29T08:23:43+00:00","fetched_at":"2026-10-29T08:23:43+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}