Live › vulnerability › CVE-2025-62841
QNAP Hybrid Backup Sync and HBS 3 contain a hard-coded cryptographic key. A remote attacker who knows or extracts that key can compromise the affected NAS backup system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 08:23 UTC. All times on this page are UTC.
Teams that run QNAP NAS devices with Hybrid Backup Sync or HBS 3 installed are exposed. Systems without these apps installed, or with the app reachable only on a trusted local network, are less exposed; the sources do not say more.
No product ranges from the sources yet.
26.4.0.521 or later26.4.0.521 or later26.4.1.563 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.
We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.1.563 and later
This page as .md · .json · in your agent: get_signal("CVE-2025-62841")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.