CVE-2025-62840

published 2026-01-02

CVE-2025-62840: A generation of error message containing sensitive information vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local…

high 7 CVSS 4.0

AV P AC L AT N PR N UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A generation of error message containing sensitive information vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the vulnerability to read application data.

We have already fixed the vulnerability in the following version:
HBS 3 Hybrid Backup Sync 26.2.0.938 and later

Affected

2 ranges

Vendor	Product	Version range	Fixed in
qnap	hybrid_backup_sync	< 26.2.0.938	26.2.0.938
qnap_systems_inc	hbs_3_hybrid_backup_sync	>= 26.1.x < 26.2.0.938	26.2.0.938

CWE-209