---
id: "CVE-2025-62841"
kind: "vulnerability"
aliases: ["CVE-2025-62841"]
title: "QNAP Hybrid Backup Sync: hard-coded key lets remote attackers compromise the system"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["hybrid-backup-sync", "infrastructure", "nas", "qnap", "self-hosted"]
not_affected_if: ["app-not-installed"]
published_at: "2026-10-29T08:17:00+00:00"
first_seen_at: "2026-10-29T08:23:43+00:00"
updated_at: "2026-10-29T08:24:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62841", "first_seen_at": "2026-10-29T08:23:43+00:00"}]
---

# QNAP Hybrid Backup Sync: hard-coded key lets remote attackers compromise the system

QNAP Hybrid Backup Sync and HBS 3 contain a hard-coded cryptographic key. A remote attacker who knows or extracts that key can compromise the affected NAS backup system.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Hybrid Backup Sync or HBS 3 version in the QNAP App Center or the app's About screen
- Compare the version against the fixed releases listed in the sources
- Confirm whether the backup service is reachable from the internet

## Fix

- HBS 3 Hybrid Backup Sync: `26.4.0.521` or later
- Hybrid Backup Sync: `26.4.0.521` or later
- Hybrid Backup Sync: `26.4.1.563` or later

## Timeline

- 2026-10-29T08:23:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-62841

## From the sources

An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.

We have already fixed the vulnerability in the following version:
HBS 3 Hybrid Backup Sync 26.4.0.521 and later
Hybrid Backup Sync 26.4.0.521 and later
Hybrid Backup Sync 26.4.1.563 and later

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_