Hyper Data Protector
CVE-2025-59389
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Hyper Data Protector web interface
-
DeliverySend crafted request with SQL payload
-
ExploitInject into backend database query
-
ExecutionExecute unauthorized code or commands
-
ImpactCompromise backup data and host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network reachability - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote unauthenticated exploitation of QNAP Hyper Data Protector requiring no authentication and no user interaction. The primary limiting factor is exposure: the Hyper Data Protector management interface must be network-accessible to the attacker, and since it is an optional VM-backup application installed on QNAP NAS devices (not a default service), only deployments running this specific application are affected. Versions prior to 2.2.4.1 are vulnerable; upgrading to 2.2.4.1 or later remediates it. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable SQL injection that requires no privileges and no user interaction, with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) - a genuinely dangerous profile for an unauthenticated flaw. However, the signals conflict on urgency: EPSS is only 0.12% (31st percentile), the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced, so there is no evidence of active or imminent mass exploitation. The vendor's own 4.0 score of 8.1 is notably lower than a straight CVSS 3.1 translation of this vector would yield (~9.8), which is an artifact of CVSS 4.0's scoring model rather than a contradiction. Net assessment: this is a technically serious unauthenticated SQLi that should be patched promptly, but current intelligence points to low real-world exploitation likelihood rather than an emergency. The description's phrase 'execute unauthorized code or commands' implies the SQLi can be escalated to command execution, but the single vendor advisory provides no technical detail to confirm the exact mechanism - verify with QNAP before assuming RCE. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker who can reach the Hyper Data Protector web interface sends a crafted request containing malicious SQL that is injected into a backend query. Per the vendor, this can be leveraged to execute unauthorized code or commands, potentially compromising the backup appliance. No public exploit code is identified at time of analysis, so exploitation currently requires the attacker to independently develop the injection payload. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 15, 2026
SQL injection in QNAP Hyper Data Protector allows unauthenticated remote attackers to execute unauthorized code or commands on affected QNAP NAS devices. The flaw affects versions prior to 2.2.4.1, which is the vendor-released patch. No public exploit code has been identified at time of analysis, and the EPSS score is low at 0.12%, though the vulnerability carries a high severity rating due to the potential for complete compromise of confidentiality, integrity, and availability.
Earlier versions of this analysis (1)
QNAP Hyper Data Protector SQL injection enables unauthorized command execution on the backup system database.
RemediationAI
Upgrade to Hyper Data Protector 2.2.4.1 or later as per QNAP security advisory QSA-25-48. This is the only definitive remediation. As a compensating control until patching is possible, restrict network access to the Hyper Data Protector management interface to trusted internal networks or VPN users only, and avoid exposing it directly to the internet; this reduces the attack surface but may limit legitimate remote management. Additionally, monitor for suspicious SQL injection attempts or unexpected command execution in logs. No other workarounds are documented by the vendor.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a SQL injection (CWE-89) in the management interface of QNAP Hyper Data Protector, a backup solution for virtual machines running on QNAP NAS devices. The CPE data identifies affected products as qnap:hyper_data_protector, with version 2.0.0.1115 beta explicitly listed and all versions prior to 2.2.4.1 considered vulnerable. SQL injection occurs when user-supplied input is improperly neutralized before being incorporated into SQL queries, allowing an attacker to alter query logic, potentially leading to unauthorized code execution or command execution as described in the advisory. The management interface is typically web-accessible, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the attack is network-reachable, low complexity, and requires no authentication or user interaction. The independent assessment using CVSS 3.1 confirms the same profile with high impact to confidentiality, integrity, and availability (C:H/I:H/A:H).
Know when Hyper Data Protector gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N) with vendor-stated command execution yields full C/I/A impact; no scope change evidenced.
Primary rating from Vendor (qnapsecurity).
CVSS VectorVendor: qnapsecurity
Lifecycle Timeline
4DescriptionCVE.org
An SQL injection vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following versions: Hyper Data Protector 2.2.4.1 and later
Zero Day Initiative Advisories
Executive ViewAI
QNAP Hyper Data Protector, the backup and data-protection service that runs on QNAP NAS appliances, is affected by a high-severity SQL injection vulnerability (CVE-2025-59389) that could allow an attacker who can reach the service to execute unauthorized code or commands on the device. Because these appliances typically store corporate backup data, snapshots, and privileged credentials, a successful compromise could expose, alter, or destroy recovery data and directly undermine business continuity and ransomware resilience. No public exploit code has been identified at time of analysis and the EPSS score is low, but the severity rating reflects complete loss of confidentiality, integrity, and availability, so exposure across the NAS estate should be treated as urgent pending verified remediation.
Apply vendor patch (Hyper Data Protector 2.2.4.1 or later per the advisory), and confirm patch status directly with QNAP given conflicting feed metadata. Until the fix is verified in place, restrict Hyper Data Protector access to trusted management networks or VPN only, block all internet-facing exposure, disable the service where not required, rotate credentials and tokens used by affected appliances, and monitor NAS and application logs for anomalous activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
GitHub PoC
Exploit-DB