HBS 3 Hybrid Backup Sync: Hard-coded cryptographic key
Summary
QNAP HBS 3 Hybrid Backup Sync and Hybrid Backup Sync, a backup application for QNAP NAS devices, contain a hard-coded cryptographic key (CWE-321). According to the CNA, a remote attacker could compromise the security of the system if the flaw is exploited. The CVSS vector rates the attack as network-reachable without privileges or user interaction, but the attack vector is labelled inconsistently across sources, so exposure should be assumed to be broad until QNAP's advisory confirms the details.
Affected
- HBS 3 Hybrid Backup Sync 26.4.x before 26.4.0.521
- Hybrid Backup Sync 26.4.x before 26.4.0.521 and before 26.4.1.563
- Older branches (for example 25.1.x or 26.1.x): Unknown.
Fixed in
- HBS 3 Hybrid Backup Sync 26.4.0.521 and later
- Hybrid Backup Sync 26.4.0.521 and later
- Hybrid Backup Sync 26.4.1.563 and later
(Per the CNA record; QNAP's advisory was not retrieved and should be checked.)
Workaround
Unknown. No vendor workaround was found; the sources recommend upgrading. Interim measure (not from a source): restrict the NAS management interface and backup services to trusted networks and do not expose the NAS directly to the internet.
Exploitation
- No evidence of in-the-wild exploitation found.
- Not listed in the CISA KEV catalogue.
- No public proof of concept found.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- EPSS: 0.25 % (percentile 16).
- HBS has been abused before: in 2021 ransomware used a patched HBS flaw against internet-exposed NAS devices running old versions.
Our recommendation
- Update HBS 3 Hybrid Backup Sync and Hybrid Backup Sync to the fixed versions listed above.
- Confirm the affected and fixed versions on QNAP's own advisory.
- Inventory all QNAP NAS devices running HBS, including older branches, and check whether any of them are reachable from the internet.
- Remove direct internet exposure of NAS management and backup services.
- Verify the integrity of backup data and review access logs for unusual activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- QNAP app release notes (HBS 3) www.qnap.com
- VulDB CVE-2025-62839 (vuln 428324) vuldb.com
- CVE record mirror (threatint) cve.threatint.com
- OffSeq threat radar entry radar.offseq.com
- BleepingComputer: QNAP removes backdoor account in HBS www.bleepingcomputer.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:43.
Original description (NVD)
An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.1.563 and later
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.