A hard‑coded password is present in QNAP Hyper Data Protector, classified as CWE‑259. The vulnerability allows remote attackers to authenticate using the embedded credentials and gain unauthorized access to the system. This can result in a compromise of confidentiality and integrity of the protected data, as the attacker can read, modify, or delete data with the authenticated session. The vendor confirms that the problem is a use of a hard‑coded password and that the remote attackers can then exploit it to gain unauthorized access.

All releases of QNAP Hyper Data Protector prior to version 2.3.1.455 contain the vulnerable hard‑coded password. Versions 2.3.1.455 and later include the vendor‑supplied fix and are not affected.

The CVSS score of 6.6 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote and requires network access to the Hyper Data Protector service; this inference is made based on the description that remote attackers can exploit the vulnerability to gain unauthorized access.