CVE-2025-62840CWE-209

CVE-2025-62840

Low · published January 2, 2026

CVSS v3.1
3.3
EPSS
0%
Percentile
14.4
In the wild
Unconfirmed
What it is

A generation of error message containing sensitive information vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the vulnerability to read application data.

We have already fixed the vulnerability in the following version:

HBS 3 Hybrid Backup Sync 26.2.0.938 and later

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00241 · 14.4th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2026-01-02T21:17Z
Affected products (1)
ProductVersionsFixed in
qnap/hybrid_backup_sync< 26.2.0.93826.2.0.938
References (1)
https://www.qnap.com/en/security-advisory/qsa-25-46 · [email protected]
EPSS history
Timeline
  • 02 JAN 15:51Z
    HBS 3 Hybrid Backup Sync
    cvelistv5