CVE-2025-59388

CRITICAL

A use of hard-coded password vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to gain unauthorized access. We have already fi...

Affects 1 product across 1 vendor.

BCS6.71
CVSS 3.19.8
CVSS v46.6
EPSS0.5%
Percentile38th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-259: CWE-259
◆ SAGE Intelligence — CITED Relevance Research Team

A use of hard-coded password vulnerability in Hyper Data Protector allows remote attackers to gain unauthorized access.

BSID: BS-2026-GLOBAL-299080-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-59388?
A use of hard-coded password vulnerability in Hyper Data Protector allows remote attackers to gain unauthorized access.
What is the CVSS score for CVE-2025-59388?
CVE-2025-59388 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.5%.
Is CVE-2025-59388 actively exploited?
No confirmed active exploitation of CVE-2025-59388 as of 2026-05-30.
How do I remediate CVE-2025-59388?
Priority: IMMEDIATE. Advisory: https://www.qnap.com/en/security-advisory/qsa-25-48 PSIRT: [email protected]
What systems are affected by CVE-2025-59388?
CVE-2025-59388 affects: Qnap.
Vulnerability Details
CVE IDCVE-2025-59388
BSIDBS-2026-GLOBAL-299080-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2026-03-12
Last Modified2026-03-16
ICS Relevance55%
Weakness (CWE)
CWE-259
SourceNVD
Official Description

A use of hard-coded password vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to gain unauthorized access. We have already fixed the vulnerability in the following version: Hyper Data Protector 2.3.1.455 and later

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Remote attackers can exploit the hard-coded password vulnerability to authenticate and access the system without proper authorization.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductFixed Version
Qnap Hyper Data Protector —
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: July 2026 | Threat Age: 135 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
SAGE Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash7431c0608543169e6363068849e1a6a7aacb27abfd2d895212d37ac0dbf4b6d897c8f39a9bea6c08703b0d3c46adad64c90ca46c20d9d2ea09909fd815372d9c
Related CVEs affecting Qnap
CVE-2017-7876 10.0 This command injection vulnerability in QTS allows attackers to run arbitrary... CVE-2024-32766 10.0 An OS command injection vulnerability has been reported to affect several QNA... CVE-2024-32764 9.9 A missing authentication for critical function vulnerability has been reporte... CVE-2017-13071 9.8 QNAP has already patched this vulnerability. This security concern allows a r... CVE-2021-38687 9.8 A stack buffer overflow vulnerability has been reported to affect QNAP NAS ru...
View all Qnap CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →