CVE-2025-59389 is an SQL injection flaw in QNAP Hyper Data Protector, scored CVSS 9.8 (critical). Remote attackers could run unauthorized code or commands. QNAP fixed it in version 2.2.4.1 and later, so check your build against advisory QSA-25-48 and update.
What's affected
The record names QNAP Hyper Data Protector and quotes the vendor: fixed in 2.2.4.1 and later. The same advisory, QSA-25-48, covers CVE-2025-59388, a hard-coded password flaw fixed in 2.3.1.455 and later. Two numbers for one product usually mean different release lines, so use the advisory to match your line.
The weakness is tagged CWE-89. I could not load the QNAP page text, so this guide follows the NVD record.
How to check if you're exposed
Find the Hyper Data Protector version in the product's about page and compare it with QSA-25-48. If you are below the fixed version for your line, you are exposed.
Also check who can reach the service over the network. A management port open to a wide internal range or to the internet makes the issue easier to reach.
What to do now
- Update to the fixed version for your release line.
- Restrict network access to the product's management and API ports.
- Take a backup of the product's configuration before the update.
- Review logs for malformed requests or unexpected database errors.
- Apply the update for CVE-2025-59388 at the same time.
Why it matters
The class is CWE-89, SQL injection. The application builds a database query from input without keeping data and commands apart, so crafted input can change what the query does. The record says this can lead to unauthorized code or command execution.
The usual defence is parameterized queries and least privilege for the database account. As a customer you cannot add those to a closed product, so the update and network limits are your controls. The KEV flag is false.
Quick check
What is SQL injection in one line?
It is input that gets treated as part of a database command instead of as plain data.
Sources
Last reviewed: 19 October 2026.
