CVE-2024-53695

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A buffer overflow vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to modify memory or crash processes.

We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 25.1.4.952 and later

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-120 CWE-121

Affected software

Vendor	Product	Versions
QNAP Systems Inc.	HBS 3 Hybrid Backup Sync	>= 25.1.x, < 25.1.4.952

References

https://www.qnap.com/en/security-advisory/qsa-25-06Vendor Advisory

Timeline

Published: Mar 7, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-536964.9A server-side request forgery (SSRF) vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow rem CVE-2024-536977.2An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability cou CVE-2024-536984.9A double free vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow CVE-2024-536997.2An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability cou CVE-2024-53706.1A vulnerability was found in Kashipara College Management System 1.0. It has been rated as problematic. Affected by this issue is some unkno CVE-2024-537007.2A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote attackers who have g CVE-2024-537013.1Multiple FCNT Android devices provide the original security features such as "privacy mode" where arbitrary applications can be set not to b CVE-2024-537025.3Use of cryptographically weak pseudo-random number generator (PRNG) vulnerability in the SonicWall SMA100 SSLVPN backup code generator that,CVE-2024-537038.1A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web serv CVE-2024-537049.8An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.CVE-2024-537057.5A Server-Side Request Forgery vulnerability in the SonicOS SSH management interface allows a remote attacker to establish a TCP connection t CVE-2024-537067.8A vulnerability in the Gen7 SonicOS Cloud platform NSv, allows a remote authenticated local low-privileged attacker to elevate privileges to