QNAP Hybrid Backup Sync vulnerabilities

6 CVEs affecting QNAP Hybrid Backup Sync, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-62842, published 2026-01-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-28799: QNAP NAS Improper Authorization Vulnerability, published 2021-05-13. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-31. EPSS: 78.3% chance of exploitation in the next 30 days. An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This…
CVE-2021-28809, published 2021-07-08. Critical severity, CVSS 9.8. EPSS: 16.1% chance of exploitation in the next 30 days. An improper access control vulnerability has been reported to affect certain legacy versions of HBS 3. If exploited, this vulnerability allows attackers to compromise the security of the operating…
CVE-2024-50388, published 2024-12-06. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to execute commands. We have already fixed…
CVE-2024-53695, published 2025-03-07. Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days. A buffer overflow vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to modify memory or crash processes. We have…
CVE-2025-62842, published 2026-01-02. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the vulnerability to read…
CVE-2025-62840, published 2026-01-02. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. A generation of error message containing sensitive information vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the…