CVE-2025-62839

Publié : 29 octobre 2026

Modifié : 29 octobre 2026

Description détaillée

An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.1.563 and later

Références et Patchs

https://www.qnap.com/en/app-release-notes?keyword=HBS%203&app=HybridBackup&product-line=nas https://www.qnap.com/en/app-release-notes?keyword=Hybrid&app=HybridBackup&product-line=nas

Dernières Vulnérabilités

CVE-2026-85268

A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID.

VOIR DÉTAILS

CVE-2026-22114

HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.

VOIR DÉTAILS

CVE-2026-22110

The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.

VOIR DÉTAILS