CVE-2021-28799criticalunder attackransomwareCWE-285

CVE-2021-28799: critical vulnerability in QNAP Systems Inc. HBS 3

Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)

Published · Updated

Follow this CVE+ Monitor Network Attached Storage+ Monitor HBS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

95Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 10epss 78%
from disclosure to weapon
Published on NVDMay 13
CISA KEV+322d
Action required by CISAfederal deadline: 2022-04-21

Apply updates per vendor instructions.

In short

A flaw in QNAP's HBS 3 backup software allows attackers to log into NAS devices without proper credentials. This is critical because it gives unauthorized users full access to stored data and system controls.

Technical detail

An improper authorization vulnerability in HBS 3 permits remote unauthenticated attackers to bypass authentication mechanisms and gain administrative access to QNAP NAS appliances. The vulnerability affects multiple QTS and QuTS hero versions; exploitation requires network access but no user interaction or valid credentials.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
QNAP Systems Inc. · HBS 1.3QNAP Systems Inc. · HBS 2QNAP Systems Inc. · HBS 3
Related CVEs — QNAP Systems Inc. HBS 3

In the same product, most dangerous first.

CVE-2021-28809CRITICALMissing Authentication for Critical Function in RTRR Server in HBS3EPSS 16.1%