CVE-2025-59388
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
A use of hard-coded password vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to gain unauthorized access. We have already fixed the vulnerability in the following version: Hyper Data Protector 2.3.1.455 and later
Analysis
QNAP Hyper Data Protector before 2.3.1.455 contains hard-coded credentials that allow remote unauthenticated attackers to gain unauthorized access to backup management functions, potentially compromising all backed-up data across the organization.
Technical Context
The application embeds hard-coded credentials (CWE-259) that cannot be changed by administrators. Any attacker who discovers these credentials (through reverse engineering or public disclosure) can authenticate to the backup system remotely.
Affected Products
QNAP Hyper Data Protector before 2.3.1.455
Remediation
Update to Hyper Data Protector 2.3.1.455 or later. Restrict network access to the backup management interface. Audit backup access logs for unauthorized connections.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today