Dashboard / CVE-2025-62841

CVE-2025-62841

HIGH
MEDIUM Priority: 0.00 BB Relevance: 62/100
Published: 2026-10-29 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Adjacent Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Adjacent
AC: Low
PR: None
UI: None
AT: None
VC: High
VI: High
VA: High

Description

An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.1.563 and later

Weakness Classification (1)

Affected Software (6)

VendorProductVersion
QNAP Systems Inc. HBS 3 Hybrid Backup Sync 26.4.x < 26.4.0.521
QNAP Systems Inc. HBS 3 Hybrid Backup Sync 26.4.x < 26.4.0.521
QNAP Systems Inc. Hybrid Backup Sync 26.4.x < 26.4.0.521
QNAP Systems Inc. Hybrid Backup Sync 26.4.x < 26.4.1.563
QNAP Systems Inc. Hybrid Backup Sync 26.4.x < 26.4.0.521
QNAP Systems Inc. Hybrid Backup Sync 26.4.x < 26.4.1.563

References & Advisories (2)

Bug Bounty Relevance

62 / 100
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

8.7 / 10.0 v4.0
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

No EPSS data available

Intelligence Sources

mitre ref →
nvd ref →

External Links