---
id: "CVE-2025-62839"
kind: "vulnerability"
aliases: ["CVE-2025-62839"]
title: "QNAP Hybrid Backup Sync: hard-coded key lets remote attackers compromise the system"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["hybrid-backup-sync", "infrastructure", "nas", "qnap", "self-hosted"]
not_affected_if: ["app-not-installed", "fixed-version"]
published_at: "2026-10-29T08:16:59+00:00"
first_seen_at: "2026-10-29T08:23:43+00:00"
updated_at: "2026-10-29T08:24:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62839", "first_seen_at": "2026-10-29T08:23:43+00:00"}]
---

# QNAP Hybrid Backup Sync: hard-coded key lets remote attackers compromise the system

QNAP Hybrid Backup Sync (HBS 3 and Hybrid Backup Sync) contains a hard-coded cryptographic key. A remote attacker who knows or extracts that key can compromise the security of the affected system.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Hybrid Backup Sync version in the QNAP App Center or Hybrid Backup Sync app.
- Confirm whether the HBS 3 or Hybrid Backup Sync app is installed on the NAS at all.

## Fix

- HBS 3 Hybrid Backup Sync: `26.4.0.521` and later
- Hybrid Backup Sync: `26.4.0.521` and later, or `26.4.1.563` and later

## Timeline

- 2026-10-29T08:23:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-62839

## From the sources

An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.

We have already fixed the vulnerability in the following version:
HBS 3 Hybrid Backup Sync 26.4.0.521 and later
Hybrid Backup Sync 26.4.0.521 and later
Hybrid Backup Sync 26.4.1.563 and later

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_