PT-2025-46142 · Qnap · Qnap Hbs 3+1

Published 2025-11-08 · Updated 2026-03-30 · CVE-2025-62840

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions QNAP HBS 3 (Hybrid Backup Sync) versions prior to 26.2.0.938

Description A flaw exists in QNAP HBS 3 (Hybrid Backup Sync) related to incorrect path restriction for an access-limited directory. Successful exploitation by a remote attacker could lead to unauthorized access to protected information. The issue involves the generation of error messages containing sensitive information. If an attacker gains local network access, they can exploit this to read application data.

Recommendations Update to HBS 3 Hybrid Backup Sync version 26.2.0.938 or later.

Fix

Generation of Error Message Containing Sensitive Information

Path traversal

Weakness Enumeration

CWE-209

CWE-22

Related Identifiers

BDU:2025-16029

CVE-2025-62840

ZDI-26-242

Affected Products

Hybrid Backup Sync

Qnap Hbs 3

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-62840 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62840 · Vendor Advisory
• https://qnap.com/en/security-advisory/qsa-25-46 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-26-242 · Security Note
• https://bdu.fstec.ru/vul/2025-16029 · Security Note
• https://reddit.com/r/pwnhub/comments/1otfbrc/qnap_faces_security_threats_after_pwn2own_ireland · Reddit Post
• https://twitter.com/CVEnew/status/2007124824993509671 · Twitter Post
• https://t.me/CVEtracker/41256 · Telegram Post
• https://t.me/true_secator/7607 · Telegram Post
• https://securityonline.info/critical-warning-qnap-patches-seven-zero-days-exploited-at-pwn2own-2025 · Note
• https://cybersecuritynews.com/qnap-zero-day-vulnerabilities-exploited · Note