CVE-2025-62841

HighCVSS 8.7/10Last modified Nov 4, 2026

Description

An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.

We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.1.563 and later

Metrics

CVSS 4.0 8.7/10CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-321

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 29, 2026
Last modified
Nov 4, 2026
NVD status
Awaiting Analysis

Related CVEs from 2025

CVE-2025-628427.8An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local netwCVE-2025-628436.8An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gainsCVE-2025-628445.5A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the CVE-2025-628456.7An improper neutralization of escape, meta, or control sequences vulnerability has been reported to affect QHora. If a local attacker gains CVE-2025-628466.7An SQL injection vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit CVE-2025-628477.5An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versiCVE-2025-628487.5A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then eCVE-2025-628499.8An SQL injection vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit theCVE-2025-62856.1A vulnerability was found in PHPGurukul COVID19 Testing Management System 2021. It has been rated as problematic. This issue affects some unCVE-2025-628507.2A NULL pointer dereference vulnerability has been reported to affect QTS, QVP, QuTS cloud and QuTS hero. If a remote attacker gains an adminCVE-2025-628514.4A path traversal vulnerability has been reported to affect License Center. If a local attacker gains an administrator account, they can thenCVE-2025-628526.5A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administra
CVE-2025-62841: High severity, CVSS 8.7 | Vulnix