Hybrid Backup Sync vulnerabilities

6 known vulnerabilities in Hybrid Backup Sync from QNAP. 6 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  HBS 3 Hybrid Backup Sync: Use of Hard-coded Cryptographic Key

  CVE-2025-62841Oct 29, 2026QNAP

  An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the v

• 8.7 High severity

  HBS 3 Hybrid Backup Sync: Use of Hard-coded Cryptographic Key

  CVE-2025-62839Oct 29, 2026QNAP

  An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the v

• 7.8 High severity

  HBS 3 Hybrid Backup Sync: External Control of File Name or Path

  CVE-2025-62842Jan 2, 2026QNAP

  An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the vulnerability to read or modify files or directories. We have already fixed the vu

• 9.1 Critical severity

  HBS 3 Hybrid Backup Sync: Buffer Copy without Checking Size of Input

  CVE-2024-53695Mar 7, 2025QNAP

  A buffer overflow vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to modify memory or crash processes. We have already fixed the vulnerability in the following version: HBS 3 Hybr

• 9.8 Critical severity

  HBS 3 Hybrid Backup Sync: Improper Neutralization of Special Elements used in a Command

  CVE-2024-50388Dec 6, 2024QNAPEPSS 2.3%

  An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to execute commands. We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup

• 9.8 Critical severity

  QNAP NAS Improper Authorization Exploited

  CVE-2021-28799May 13, 2021QNAPEPSS 78.3%

  An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0