CVE-2025-62841: Hard-coded Cryptographic Key #2

Q: Which releases should be updated?

Update HBS 3 Hybrid Backup Sync to version 26.4.0.521 or later. For Hybrid Backup Sync, the advisory lists 26.4.0.521 or later and 26.4.1.563 or later as fixed versions.

Q: What could exploitation allow an attacker to do?

A remote attacker who exploits the hard-coded cryptographic key vulnerability could compromise the security of the system.

Published Oct 29, 2026

Updated

An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.

We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.1.563 and later

Affected Software

2 affected components

QNAP HBS 3 Hybrid Backup Sync<26.4.0.521

QNAP Hybrid Backup Sync<26.4.0.521, <26.4.1.563

Event History

Oct 29, 2026

CVE Published

via MITRE·07:40 AM

Data Sourced

via MITRE·07:40 AM

RemedyDescriptionWeakness

Frequently Asked Questions

Which releases should be updated?

Update HBS 3 Hybrid Backup Sync to version 26.4.0.521 or later. For Hybrid Backup Sync, the advisory lists 26.4.0.521 or later and 26.4.1.563 or later as fixed versions.

What could exploitation allow an attacker to do?

A remote attacker who exploits the hard-coded cryptographic key vulnerability could compromise the security of the system.

CVE-2025-62841: Hard-coded Cryptographic Key #2

Affected Software

Event History

Frequently Asked Questions

Which releases should be updated?

What could exploitation allow an attacker to do?

Company

Resources

Contact

Frequently Asked Questions

Which releases should be updated?

What could exploitation allow an attacker to do?