HackZoneLabs News
Newsletter

CVE-2021-28799

Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)

  • Critical 10.0
  • Exploited: added to CISA KEV 31 Mar 2022
  • Used in ransomware campaigns

Description

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

Key facts

Published
13 May 2021
Last changed
21 Oct 2025
Assigned by
qnap
KEV added
31 Mar 2022
KEV fix due
21 Apr 2022
Used in ransomware
Yes, according to CISA
EPSS
78.25% likely to be exploited in the next 30 days, higher than 99.585% of CVEs (scores for 15 Nov 2026)
SSVC (CISA)
Exploitation: active; Automatable: yes; Technical impact: total

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

  • 10.0CVSS 3.1, Criticalfrom the CNA (qnap)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What to do

  • QNAP have already fixed this vulnerability in the following versions of HBS 3: QTS 4.5.2: HBS 3 v16.0.0415 and later QTS 4.3.6: HBS 3 v3.0.210412 and later QTS 4.3.3 and 4.3.4: HBS 3 v3.0.210411 and later QuTS hero h4.5.1: HBS 3 v16.0.0419 and later QuTScloud c4.5.1~c4.5.4: HBS 3 v16.0.0419 and laterCNA solution statement
  • Apply updates per vendor instructions.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

VendorProductVersions
QNAP Systems Inc.HBS 3
  • unspecified up to but excluding v16.0.0415 (affected)
QNAP Systems Inc.HBS 3
  • unspecified up to but excluding v3.0.210412 (affected)
QNAP Systems Inc.HBS 3
  • unspecified up to but excluding v3.0.210411 (affected)
QNAP Systems Inc.HBS 3
  • unspecified up to but excluding v3.0.210411 (affected)
QNAP Systems Inc.HBS 3
  • unspecified up to but excluding v16.0.0419 (affected)
QNAP Systems Inc.HBS 3
  • unspecified up to but excluding v16.0.0419 (affected)
QNAP Systems Inc.HBS 2
  • all versions (unaffected)
QNAP Systems Inc.HBS 1.3
  • all versions (unaffected)

Timeline

  1. 13 May 2021 Published
  2. 31 Mar 2022 CVE-2021-28799 added to CISA KEV
  3. 31 Mar 2022 Added to the CISA KEV catalogue

Weakness

References