{"id":"CVE-2025-62841","kind":"vulnerability","aliases":["CVE-2025-62841"],"related":[],"title":"QNAP Hybrid Backup Sync: hard-coded key lets remote attackers compromise the system","description":"An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nHBS 3 Hybrid Backup Sync 26.4.0.521 and later\nHybrid Backup Sync 26.4.0.521 and later\nHybrid Backup Sync 26.4.1.563 and later","summary":"QNAP Hybrid Backup Sync and HBS 3 contain a hard-coded cryptographic key. A remote attacker who knows or extracts that key can compromise the affected NAS backup system.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hybrid-backup-sync","infrastructure","nas","qnap","self-hosted"],"not_affected_if":["app-not-installed"],"how_to_check":"- Check the installed Hybrid Backup Sync or HBS 3 version in the QNAP App Center or the app's About screen\n- Compare the version against the fixed releases listed in the sources\n- Confirm whether the backup service is reachable from the internet","fix":"- HBS 3 Hybrid Backup Sync: `26.4.0.521` or later\n- Hybrid Backup Sync: `26.4.0.521` or later\n- Hybrid Backup Sync: `26.4.1.563` or later","status":"open","published_at":"2026-10-29T08:17:00+00:00","first_seen_at":"2026-10-29T08:23:43+00:00","triaged_at":"2026-10-29T08:24:20+00:00","updated_at":"2026-10-29T08:24:20+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-29T08:24:20Z","model":"claude-haiku-5-5","output":{"fix":"- HBS 3 Hybrid Backup Sync: `26.4.0.521` or later\n- Hybrid Backup Sync: `26.4.0.521` or later\n- Hybrid Backup Sync: `26.4.1.563` or later","reach":"internet","title":"QNAP Hybrid Backup Sync: hard-coded key lets remote attackers compromise the system","impact":"high","summary":"QNAP Hybrid Backup Sync and HBS 3 contain a hard-coded cryptographic key. A remote attacker who knows or extracts that key can compromise the affected NAS backup system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["qnap","nas","hybrid-backup-sync","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"remote attacker compromises the backup system via hard-coded key","analyst_note":"Sources do not say whether authentication is required or which features use the key; check the QNAP advisory for exploitation details.","how_to_check":"- Check the installed Hybrid Backup Sync or HBS 3 version in the QNAP App Center or the app's About screen\n- Compare the version against the fixed releases listed in the sources\n- Confirm whether the backup service is reachable from the internet","plain_action":"","needs_analyst":true,"not_affected_if":["app-not-installed"],"who_is_affected":"Teams that run QNAP NAS devices with Hybrid Backup Sync or HBS 3 installed are exposed. Systems without these apps installed, or with the app reachable only on a trusted local network, are less exposed; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00073,"input_tokens":4215,"output_tokens":616,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2025':16A,19A '-62841':17A,20A '26.4.0.521':114C,120C '26.4.1.563':126C '3':37B,76C,110C 'affect':57B,74C 'allow':89C 'alreadi':101C 'attack':11A,47B,91C 'backup':3A,23B,33B,59B,78C,82C,112C,118C,124C 'code':7A,42B,66C 'compromis':12A,55B,93C 'contain':38B 'could':88C 'cryptograph':43B,67C 'cve':15A,18A 'exploit':85C 'extract':51B 'fix':102C 'follow':107C 'hard':6A,41B,65C 'hard-cod':5A,40B,64C 'hbs':36B,75C,109C 'host':30B 'hybrid':2A,22B,32B,77C,81C,111C,117C,123C 'hybrid-backup-sync':21B 'infrastructur':25B 'key':8A,44B,53B,68C 'know':49B 'later':116C,122C,128C 'let':9A 'nas':26B,58B 'qnap':1A,27B,31B 'remot':10A,46B,90C 'report':72C 'secur':95C 'self':29B 'self-host':28B 'sync':4A,24B,34B,79C,83C,113C,119C,125C 'system':14A,60B,98C 'use':62C 'version':108C 'vulner':69C,87C,104C","nicknames":[],"mitigations":[],"who_affected":"Teams that run QNAP NAS devices with Hybrid Backup Sync or HBS 3 installed are exposed. Systems without these apps installed, or with the app reachable only on a trusted local network, are less exposed; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T08:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@qnapsecurity.com.tw","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-62841","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62841","severity":null,"published_at":"2026-10-29T08:17:00+00:00","modified_at":"2026-10-29T08:17:00+00:00","first_seen_at":"2026-10-29T08:23:43+00:00","fetched_at":"2026-10-29T08:23:43+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}