Cyber Posture

CVE-2025-59388

Critical

Published: 12 March 2026

Published
12 March 2026
Modified
16 March 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0019 40.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

A use of hard-coded password vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to gain unauthorized access. We have already fixed the vulnerability in the following version: Hyper Data Protector 2.3.1.455…

more

and later

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly requires timely remediation of software flaws like this hard-coded password vulnerability to prevent unauthorized remote access.

SI-5 Security Alerts, Advisories, and Directives good match
prevent

Ensures receipt and implementation of vendor security advisories, such as QNAP's for CVE-2025-59388, to apply patches preventing exploitation.

IA-5 Authenticator Management good match
prevent

Mandates secure management of authenticators, explicitly preventing the use of unmanageable hard-coded passwords in systems.

Security SummaryAI

CVE-2025-59388 is a use of hard-coded password vulnerability (CWE-259) affecting Hyper Data Protector software. Published on 2026-03-12, it enables remote attackers to exploit the hard-coded credentials for unauthorized access to the affected component.

Attackers require only network access to the vulnerable Hyper Data Protector instance, with no privileges, authentication, or user interaction needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8). Successful exploitation grants unauthorized access, resulting in high impacts to confidentiality, integrity, and availability.

QNAP has addressed the issue in Hyper Data Protector version 2.3.1.455 and later. Additional mitigation details are available in the security advisory at https://www.qnap.com/en/security-advisory/qsa-25-48.

Details

CWE(s)
CWE-259

Affected Products

qnap
hyper data protector
2.2.0.284 — 2.3.1.455

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1078.001 Default Accounts Stealth
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
Why these techniques?

Hard-coded password enables remote exploitation of public-facing application (T1190) and use of default/static credentials for unauthorized access (T1078.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References