InfoSecBulletin Cybersecurity for mankind
QNAP has urgently advised users and released patches for seven zero-day vulnerabilities exploited during the Pwn2Own Ireland 2025 competition, affecting their NAS devices. These patches address critical flaws in the core operating systems and key applications, such as backup and malware removal tools.
Top security research teams, including Summoning Team, DEVCORE, Team DDOS, and a CyCraft intern, showcased their successful exploits at Pwn2Own.
Chameleon SEO Poisoning
Hackers poison Bing and Google search results to deliver phishing banking pages
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
The vulnerabilities in the QNAP system pose a serious risk to user data on NAS devices. Patches have been released for the main operating systems, QTS and QuTS hero, along with key applications.
1. Core Operating Systems: QTS and QuTS hero
Multiple vulnerabilities (CVE-2025-62847, CVE-2025-62848, CVE-2025-62849) in QNAP’s operating systems were discovered. Although official CVSS scores are not listed, the zero-day status and context of a Pwn2Own exploit indicate a High Risk for remote code execution and data compromise.
2. Backup and Data Protection Apps
Two major applications designed to safeguard data were found to be vulnerable:
HBS 3 Hybrid Backup Sync (CVE-2025-62840, CVE-2025-62842) has multiple critical vulnerabilities that were fixed. As this tool manages backup routines, attackers could potentially access historical data and remote backups if it is compromised. Users on versions 26.1.x and earlier should update to HBS 3 version 26.2.0.938 or later.
Hyper Data Protector (CVE-2025-59389): A vulnerability in this dedicated data protection tool was fixed in version 2.2.4.1 and later.
3.Malware Remover (CVE-2025-11837)
A zero-day vulnerability was even found in QNAP’s security tool, Malware Remover. Users on versions 6.6.x must update to Malware Remover 6.6.8.20251023 and later.
The vulnerabilities were demonstrated to be exploitable in a lab setting, meaning attackers can easily use these methods in real-world scenarios. Since NAS devices store valuable data, QNAP users should update their firmware and applications right away.
