CVE-2024-53695
Published: 07 March 2025
Description
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Security Summary
CVE-2024-53695 is a buffer overflow vulnerability (CWE-120, CWE-121) in HBS 3 Hybrid Backup Sync from QNAP, published on 2025-03-07. The flaw affects this backup synchronization software, earning a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), indicating critical severity due to its potential for high impact on integrity and availability without confidentiality compromise.
Remote attackers can exploit the vulnerability over the network with low attack complexity, requiring no privileges, authentication, or user interaction. Exploitation enables arbitrary memory modification, potentially leading to data tampering or process crashes, which could disrupt backup operations or enable further compromise depending on the attacker's goals.
QNAP has mitigated the issue in HBS 3 Hybrid Backup Sync version 25.1.4.952 and later. Administrators should update affected systems immediately, as detailed in the vendor's security advisory at https://www.qnap.com/en/security-advisory/qsa-25-06.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Remote buffer overflow in public-facing backup sync service enables T1190 for initial exploitation; arbitrary memory modification facilitates T1565.001 data tampering; process crashes enable T1499.004 DoS via application exploitation.