Hybrid Backup Sync EUVD-2025-211209

Exploitation requires network adjacency to the QNAP NAS running HBS 3 / Hybrid Backup Sync (AV:A) - the attacker must be on the same local or logical network segment, not arbitrary internet distance, unless the affected service is explicitly exposed through port-forwarding or remote-access configuration. The core prerequisite is possession of the hard-coded cryptographic key (CWE-321), which is embedded in the shipped software and therefore identical for, and recoverable from, every installation. No authentication and no user interaction are needed (PR:N/UI:N), and complexity is low (AC:L). The primary limiting factors are the adjacency requirement and the need to run an affected version below the fixed builds (Hybrid Backup Sync <26.4.1.563 / <26.4.0.521, HBS 3 <26.4.0.521); the exact feature or protocol in which the key is used is not described in the available sources.

This is a serious-but-conditional flaw rather than an internet-wide emergency. The input provides a CVSS 4.0 vector (8.7) with AV:A, AC:L, AT:N, PR:N, UI:N and VC:H/VI:H/VA:H - unauthenticated, low-complexity access with full confidentiality, integrity and availability impact on the vulnerable system, but the Adjacent (AV:A) attack vector means the attacker must reach the device over a local/logical network segment rather than directly across the internet. CWE-321 (use of hard-coded cryptographic key) is inherently high-value because the key is identical across all deployments and recoverable from the shared software, so once published it affects every installed instance uniformly. However, the real-world escalators are absent or unstated: there is no EPSS score in the input, the CVE is NOT in CISA KEV, and no PoC or exploit reference is listed, so this must be treated as 'no public exploit identified at time of analysis' - not active exploitation. The vendor-assigned priority is 'this_week' (not act_now/emergency) and a patch is available, which is consistent with a high-severity issue that warrants prompt but not drop-everything remediation. One point to verify with the vendor: the description says 'remote attackers' while the CVSS vector specifies Adjacent (AV:A) access, so confirm whether exposed/port-forwarded QNAP services widen the practical reach beyond the LAN.

An attacker positioned on the same local network as a QNAP NAS (for example via a compromised LAN host or a device exposed on an untrusted segment) leverages the cryptographic key embedded in HBS 3 / Hybrid Backup Sync - a key shared across all installations - to break the confidentiality or integrity of protected communications or data on the appliance. Because authentication and user interaction are not required (PR:N/UI:N), a single adjacent, low-complexity action can fully compromise the targeted system. No public exploit code is identified in the available sources, and the precise trigger is not described.