CVEvulnerability

CVE-2021-28799

9.8 CRITICAL Known exploited Published 2021-05-13 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

QNAP NAS Improper Authorization Vulnerability — QNAP Network Attached Storage (NAS)

QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.

Added to KEV
2022-03-31
Remediation due
2022-04-21
Ransomware use
Known
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2021-28799
Status
Analyzed
Published
2021-05-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-285

Description

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

Affected configurations

• qnap hybrid backup sync (< 16.0.0415) • qnap hybrid backup sync (< 3.0.210412) • qnap hybrid backup sync (< 3.0.210411) • qnap hybrid backup sync (< 16.0.0419)

Related

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References