Critical severity · published Jan 2, 2026
CVE-2025-59389
An SQL injection vulnerability has been reported to affect Hyper Data Protector
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
An SQL injection vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following versions:
Hyper Data Protector 2.2.4.1 and later
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HD
Hyper Data Protector · Qnap
2.1.0.0226 before 2.2.4.1; 2.0.0.1115 · source: NVD
In the news
VulnerabilityHigh
ZDI-26-202: (Pwn2Own) QNAP TS-453E Hyper Data Protector Plugin query_original_file_size SQL Injection Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of QNAP TS-453E. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 8.0. The following CVEs are assigned: CVE-2025-59389.
Mar 16, 2026·Zero Day Initiative
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59389
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59389
Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-25-48
More from Hyper Data Protector
9.8
CVE-2025-59388
A use of hard-coded password vulnerability has been reported to affect Hyper Data Protector