What is the CVSS score of CVE-2025-59389?

CVE-2025-59389 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Hyper Data Protector are affected by CVE-2025-59389?

Organizations using the following face critical risk from CVE-2025-59389, a SQL injection vulnerability rated CVSS 9.8.

How to fix or mitigate CVE-2025-59389?

Within 24 hours: Identify all affected systems running the following and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Hyper Data Protector CVE-2025-59389

CRITICAL

SQL Injection (CWE-89)

2026-01-02 security@qnapsecurity.com.tw

SQLi Hyper Data Protector

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 02, 2026 - 16:17 nvd

CRITICAL 9.8

DescriptionCVE.org

An SQL injection vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following versions: Hyper Data Protector 2.2.4.1 and later

AnalysisAI

QNAP Hyper Data Protector before 2.2.4.1 has an SQL injection vulnerability that allows remote attackers to execute unauthorized commands on the backup database. Combined with CVE-2025-59388 (hardcoded credentials), this creates a critical attack chain.

Technical ContextAI

The application fails to parameterize SQL queries (CWE-89), allowing injection of arbitrary SQL commands. In a backup management system, SQL injection can expose backup metadata, credentials for protected systems, and potentially enable OS command execution through SQL-specific features (e.g., xp_cmdshell, COPY TO PROGRAM).