Hybrid Backup Sync CVE-2025-62840

Exploitation requires the attacker to already have local network access (per description) or physical proximity (per the vendor's AV:P vector) to a QNAP NAS appliance running HBS 3 Hybrid Backup Sync at a version prior to 26.2.0.938; the flaw is not reachable by remote, internet-based unauthenticated attackers. No authentication is required once proximity is obtained (PR:N) and no user interaction is needed (UI:N). The limiting factors are the adjacency requirement (local-network or physical), which excludes mass remote exploitation, and that the impact is confined to disclosure of application data via verbose error messages rather than code execution or data modification.

This is a CWE-209 information-disclosure flaw in QNAP HBS 3 Hybrid Backup Sync, reported by the vendor (security@qnapsecurity.com.tw) via advisory QSA-25-46. The signals point to a LOW-to-MODERATE real-world priority despite the 7.0 'High' score. EPSS is 0.02% (4th percentile), it is NOT on the CISA KEV list, and no public exploit code has been identified - so there is no evidence of active or imminent exploitation. There is a notable DATA CONFLICT: the vendor CVSS 4.0 vector specifies AV:P (Physical access) while the text description states 'If an attacker gains local network access' - physical and local-network are different adjacency assumptions, so the true attack vector should be verified with QNAP (the description implies adjacent-network AV:A rather than physical AV:P). A second inconsistency: the vector claims full VC:H/VI:H/VA:H (high confidentiality, integrity AND availability impact), yet the CWE-209 description describes only the ability to 'read application data' - an information-disclosure impact with no integrity or availability component, so the I/A impact ratings appear overstated. Net: a genuine but lower-urgency confidentiality issue gated behind local-network (or possibly physical) proximity, with no network-facing unauthenticated exposure and no exploitation activity observed.

An attacker already positioned on the same local network segment as a QNAP NAS running HBS 3 interacts with the application in a way that triggers a verbose error message, which leaks sensitive application data in its response. No public exploit code is known, and the attack requires local/adjacent proximity rather than internet-facing access, limiting it to insiders or attackers who have already breached the LAN.