QNAP fixes a critical zero-day flaw in HBS 3 Hybrid Backup Sync discovered during Pwn2Own
Take action: If you are running QNAP HBS 3 Hybrid Backup Sync solution, patch ASAP. The exploit was demonstrated live, so the cat is out of the bag. You will be targeted.
Learn More
QNAP has fixed a critical zero-day vulnerability, which was exploited by security researchers during the Pwn2Own Ireland 2024 competition. At the Pwn2Own event, held from October 22-25, Team Viettel from Viettel Cyber Security leveraged CVE-2024-50388 to gain administrative control over a QNAP TS-464 NAS device, ultimately winning the competition. V
The flaw is tracked as CVE-2024-50388 (CVSS score not available, QNAP ranks as Critical) is an OS command injection vulnerability and affects HBS 3 Hybrid Backup Sync (version 25.1.x) — QNAP’s disaster recovery and backup solution. If exploited, it could allow remote attackers to execute arbitrary commands on affected NAS devices.
QNAP patched this vulnerability on October 29, 2024, within five days of its demonstration at Pwn2Own. The fix is included in HBS 3 Hybrid Backup Sync version 25.1.1.673 and later. To update HBS 3:
- Log in to QTS or QuTS hero as an administrator.
- Open the App Center and search for "HBS 3 Hybrid Backup Sync."
- If an update is available, select "Update" to install it.
QNAP devices have been frequent targets for ransomware attacks due to their storage of sensitive personal data, which attackers use to demand ransom for file decryption.
