CVE-2025-59388 is a hard-coded password flaw in QNAP Hyper Data Protector, scored CVSS 9.8 (critical). Remote attackers could use it to gain unauthorized access without credentials of their own. QNAP fixed it in Hyper Data Protector 2.3.1.455 and later, so check your version now and update.
What's affected
The record names QNAP Hyper Data Protector. The vendor wording quoted in the NVD record says the fix is in 2.3.1.455 and later. QNAP's advisory QSA-25-48 covers this product together with CVE-2025-59389, an SQL injection flaw, whose fix text names version 2.2.4.1 and later.
The two different version numbers suggest separate release lines, so read QSA-25-48 for the one that matches your install. I could not load the page text, so I rely on the record.
How to check if you're exposed
Open Hyper Data Protector and check its version in the product's about or system information page. Compare it with the fixed versions in QSA-25-48 for your release line.
Because a backup tool often holds credentials for the systems it protects, also check who can reach its management interface. If it is reachable from outside your management network, treat it as higher priority.
What to do now
- Update Hyper Data Protector to the fixed version for your line, at least 2.3.1.455 for this CVE.
- Restrict the management interface to a management network or VPN.
- Review which credentials and repositories the product holds, and rotate those you consider exposed.
- Check backup job and sign in logs for activity you do not recognise.
- Apply the fix for CVE-2025-59389 in the same update.
Why it matters
The class is CWE-259, use of a hard-coded password. A password built into software is the same on every installation, so anyone who finds it can sign in to every instance that has not been patched. It cannot be rotated by customers, which is why only a vendor update fixes it.
Backup software is a high value target because it can read and restore everything it protects. A critical score is expected for a remote path to it with no credentials. The KEV flag is false.
Quick check
Can I change the password myself instead of updating?
The record describes a password built into the product, which customers usually cannot change. Update to the fixed version.
Sources
Last reviewed: 19 October 2026.
