Skip to main content

Hyper Data Protector CVE-2025-59388

CRITICAL
Use of Hard-coded Password (CWE-259)
2026-03-12 security@qnapsecurity.com.tw
Authentication Bypass Hyper Data Protector
9.8
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 19:57 vuln.today
CVE Published
Mar 12, 2026 - 02:15 nvd
CRITICAL 9.8

DescriptionNVD

A use of hard-coded password vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to gain unauthorized access.

We have already fixed the vulnerability in the following version: Hyper Data Protector 2.3.1.455 and later

AnalysisAI

QNAP Hyper Data Protector before 2.3.1.455 contains hard-coded credentials that allow remote unauthenticated attackers to gain unauthorized access to backup management functions, potentially compromising all backed-up data across the organization.

Technical ContextAI

The application embeds hard-coded credentials (CWE-259) that cannot be changed by administrators. Any attacker who discovers these credentials (through reverse engineering or public disclosure) can authenticate to the backup system remotely.

RemediationAI

Update to Hyper Data Protector 2.3.1.455 or later. Restrict network access to the backup management interface. Audit backup access logs for unauthorized connections.

Share

CVE-2025-59388 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy