CVE-2025-59389

CRITICAL
2026-01-02 [email protected]
9.8
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 02, 2026 - 16:17 nvd
CRITICAL 9.8

Tags

SQLi Hyper Data Protector

Description

An SQL injection vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following versions: Hyper Data Protector 2.2.4.1 and later

Analysis

QNAP Hyper Data Protector before 2.2.4.1 has an SQL injection vulnerability that allows remote attackers to execute unauthorized commands on the backup database. Combined with CVE-2025-59388 (hardcoded credentials), this creates a critical attack chain.

Technical Context

The application fails to parameterize SQL queries (CWE-89), allowing injection of arbitrary SQL commands. In a backup management system, SQL injection can expose backup metadata, credentials for protected systems, and potentially enable OS command execution through SQL-specific features (e.g., xp_cmdshell, COPY TO PROGRAM).

Affected Products

QNAP Hyper Data Protector before 2.2.4.1

Remediation

Update to Hyper Data Protector 2.2.4.1 or later. Address both this CVE and CVE-2025-59388 (hardcoded creds) together.

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: +0.1
CVSS: +49
POC: 0

Share

CVE-2025-59389 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy