Hybrid Backup Sync
Monthly
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Hard-coded cryptographic key use in QNAP HBS 3 Hybrid Backup Sync lets a network-adjacent, unauthenticated attacker compromise the confidentiality, integrity and availability of the NAS. Installations running HBS 3 Hybrid Backup Sync below 26.4.0.521, or Hybrid Backup Sync below 26.4.0.521 / 26.4.1.563, are affected; because the key ships inside the software it is identical on every install and recoverable from the package, so no credentials or user interaction are needed. There is no public exploit identified at time of analysis, but the vendor has released fixed builds and the exposure is rated 8.7 (CVSS 4.0) with high impact across all three pillars.
A hard-coded cryptographic key (CWE-321) in QNAP's HBS 3 Hybrid Backup Sync and Hybrid Backup Sync leaves affected NAS appliances protected by a static secret that is identical across installations. Unauthenticated attackers positioned on the same local or logical network segment (CVSS AV:A) can leverage the key to fully compromise confidentiality, integrity and availability of the backup application and, by extension, the system security it protects; no user interaction and no credentials are required. QNAP has released fixed builds, and while no public exploit code or confirmed active exploitation was identified at time of analysis, the static nature of the key means a single recovery of the secret applies to every unpatched device.
An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the vulnerability to read or modify files or directories. [CVSS 7.8 HIGH]
Information disclosure in QNAP Hybrid Backup Sync (HBS 3) prior to 26.2.0.938 allows an attacker with local network access or physical proximity to a QNAP NAS appliance to read application data through generated error messages that contain sensitive information. Exploitation requires no authentication once proximity is obtained and no user interaction, but it is not reachable by remote internet-based attackers; impact is confined to confidentiality, not code execution or data modification. No public exploit identified at time of analysis, and EPSS is low at 0.02% (4th percentile).
A buffer overflow vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. Rated critical severity (CVSS 9.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An improper access control vulnerability has been reported to affect certain legacy versions of HBS 3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Hard-coded cryptographic key use in QNAP HBS 3 Hybrid Backup Sync lets a network-adjacent, unauthenticated attacker compromise the confidentiality, integrity and availability of the NAS. Installations running HBS 3 Hybrid Backup Sync below 26.4.0.521, or Hybrid Backup Sync below 26.4.0.521 / 26.4.1.563, are affected; because the key ships inside the software it is identical on every install and recoverable from the package, so no credentials or user interaction are needed. There is no public exploit identified at time of analysis, but the vendor has released fixed builds and the exposure is rated 8.7 (CVSS 4.0) with high impact across all three pillars.
A hard-coded cryptographic key (CWE-321) in QNAP's HBS 3 Hybrid Backup Sync and Hybrid Backup Sync leaves affected NAS appliances protected by a static secret that is identical across installations. Unauthenticated attackers positioned on the same local or logical network segment (CVSS AV:A) can leverage the key to fully compromise confidentiality, integrity and availability of the backup application and, by extension, the system security it protects; no user interaction and no credentials are required. QNAP has released fixed builds, and while no public exploit code or confirmed active exploitation was identified at time of analysis, the static nature of the key means a single recovery of the secret applies to every unpatched device.
An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the vulnerability to read or modify files or directories. [CVSS 7.8 HIGH]
Information disclosure in QNAP Hybrid Backup Sync (HBS 3) prior to 26.2.0.938 allows an attacker with local network access or physical proximity to a QNAP NAS appliance to read application data through generated error messages that contain sensitive information. Exploitation requires no authentication once proximity is obtained and no user interaction, but it is not reachable by remote internet-based attackers; impact is confined to confidentiality, not code execution or data modification. No public exploit identified at time of analysis, and EPSS is low at 0.02% (4th percentile).
A buffer overflow vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. Rated critical severity (CVSS 9.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An improper access control vulnerability has been reported to affect certain legacy versions of HBS 3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.