Hbs 3 Hybrid Backup Sync
Monthly
Hard-coded cryptographic key use in QNAP HBS 3 Hybrid Backup Sync lets a network-adjacent, unauthenticated attacker compromise the confidentiality, integrity and availability of the NAS. Installations running HBS 3 Hybrid Backup Sync below 26.4.0.521, or Hybrid Backup Sync below 26.4.0.521 / 26.4.1.563, are affected; because the key ships inside the software it is identical on every install and recoverable from the package, so no credentials or user interaction are needed. There is no public exploit identified at time of analysis, but the vendor has released fixed builds and the exposure is rated 8.7 (CVSS 4.0) with high impact across all three pillars.
A hard-coded cryptographic key (CWE-321) in QNAP's HBS 3 Hybrid Backup Sync and Hybrid Backup Sync leaves affected NAS appliances protected by a static secret that is identical across installations. Unauthenticated attackers positioned on the same local or logical network segment (CVSS AV:A) can leverage the key to fully compromise confidentiality, integrity and availability of the backup application and, by extension, the system security it protects; no user interaction and no credentials are required. QNAP has released fixed builds, and while no public exploit code or confirmed active exploitation was identified at time of analysis, the static nature of the key means a single recovery of the secret applies to every unpatched device.
Hard-coded cryptographic key use in QNAP HBS 3 Hybrid Backup Sync lets a network-adjacent, unauthenticated attacker compromise the confidentiality, integrity and availability of the NAS. Installations running HBS 3 Hybrid Backup Sync below 26.4.0.521, or Hybrid Backup Sync below 26.4.0.521 / 26.4.1.563, are affected; because the key ships inside the software it is identical on every install and recoverable from the package, so no credentials or user interaction are needed. There is no public exploit identified at time of analysis, but the vendor has released fixed builds and the exposure is rated 8.7 (CVSS 4.0) with high impact across all three pillars.
A hard-coded cryptographic key (CWE-321) in QNAP's HBS 3 Hybrid Backup Sync and Hybrid Backup Sync leaves affected NAS appliances protected by a static secret that is identical across installations. Unauthenticated attackers positioned on the same local or logical network segment (CVSS AV:A) can leverage the key to fully compromise confidentiality, integrity and availability of the backup application and, by extension, the system security it protects; no user interaction and no credentials are required. QNAP has released fixed builds, and while no public exploit code or confirmed active exploitation was identified at time of analysis, the static nature of the key means a single recovery of the secret applies to every unpatched device.