QNAP HBS 3 Hybrid Backup Sync EUVD-2025-211208

Exploitation requires adjacent-network access (CVSS AV:A) - the attacker must reside on the same local/logical network segment as the QNAP NAS running HBS 3 Hybrid Backup Sync or Hybrid Backup Sync; this is NOT remotely exploitable across the open internet by vector. No authentication and no user interaction are required (PR:N/UI:N), and complexity is low (AC:L/AT:N). The core precondition is the presence of the hard-coded cryptographic key in affected versions (Hybrid Backup Sync 26.4.x below 26.4.1.563 / 26.4.0.521, and HBS 3 below 26.4.0.521); because the key is static across installations, once recovered it applies to every unpatched device. The primary limiting factor is the adjacent-network requirement; the available sources do not specify which feature, protocol or configuration mode invokes the key, so condition specifics beyond the CVSS vector are unverified. The only complete fix stated by the vendor is updating to the fixed versions.

This is a genuine but bounded priority. The vendor-assigned CVSS 4.0 score of 8.7 (High) reflects full compromise of confidentiality, integrity and availability (VC:H/VI:H/VA:H) with no privileges or user interaction required (PR:N/UI:N) and low attack complexity (AC:L/AT:N). The single most important mitigating signal is the attack vector: AV:A (Adjacent), NOT network/internet-wide - an attacker must already have a foothold on the same logical/local network segment as the QNAP NAS, which materially narrows the realistic threat compared to an AV:N flaw. The vuln.today decision label is 'this_week' (prompt action, not emergency). No CISA KEV listing is present, no EPSS probability was supplied, and the only references are QNAP release-note pages rather than exploit code, so there is no evidence of active exploitation or a working public exploit. The use of a hard-coded cryptographic key (CWE-321) is structurally serious because the secret is identical across all deployments and cannot be rotated by operators - once extracted from the firmware/application it is reusable everywhere - but the adjacent-network requirement and absence of exploitation signals place this as a 'patch promptly' item rather than a drop-everything emergency. Note the tag 'Information Disclosure' understates the rated impact, which is full CIA, not confidentiality alone.

An attacker positioned on the same local network as a QNAP NAS running an unpatched HBS 3 / Hybrid Backup Sync (e.g. via a compromised adjacent host or Wi-Fi foothold) uses the hard-coded cryptographic key - identical across all installations - to decrypt, forge or tamper with protected backup-sync communications or data, compromising the system's confidentiality and integrity. No credentials or user interaction are required (PR:N/UI:N). No public exploit identified at time of analysis; the exact trigger mechanism is not described in the available sources.