Critical severity · published Mar 12, 2026
CVE-2025-59388
A use of hard-coded password vulnerability has been reported to affect Hyper Data Protector
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
A use of hard-coded password vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to gain unauthorized access.
We have already fixed the vulnerability in the following version:
Hyper Data Protector 2.3.1.455 and later
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HD
Hyper Data Protector · Qnap
2.2.0.284 before 2.3.1.455 · source: NVD
In the news
VulnerabilityMedium
ZDI-26-201: (Pwn2Own) QNAP TS-453E Hyper Data Protector Plugin Hard-Coded Credentials Authentication Bypass Vulnerability
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of QNAP TS-453E devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.3. The following CVEs are assigned: CVE-2025-59388.
Mar 16, 2026·Zero Day Initiative
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59388
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59388
Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-25-48
More from Hyper Data Protector
9.8
CVE-2025-59389
An SQL injection vulnerability has been reported to affect Hyper Data Protector