CVE-2021-28799: QNAP NAS Improper Authorization Vulnerability

Published May 13, 2021
·
Updated

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

Other sources

QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.

— CISA

Affected Software

22 affected components
QNAP Network Attached Storage (NAS)
QNAP Hybrid Backup Sync<16.0.0415
QNAP QTS=4.5.2
QNAP Hybrid Backup Sync<3.0.210412
QNAP QTS=4.3.6
QNAP Hybrid Backup Sync<3.0.210411
QNAP QTS=4.3.3
QNAP QTS=4.3.4
QNAP Hybrid Backup Sync<16.0.0419
QNAP QuTS hero=h4.5.1
QNAP QuTScloud>=c4.5.1<=c4.5.4
All of the following
QNAP Hybrid Backup Sync<16.0.0415
QNAP QTS=4.5.2
All of the following
QNAP Hybrid Backup Sync<3.0.210412
QNAP QTS=4.3.6
All of the following
QNAP Hybrid Backup Sync<3.0.210411
Any of the following
QNAP QTS=4.3.3
QNAP QTS=4.3.4
All of the following
QNAP Hybrid Backup Sync<16.0.0419
QNAP QuTS hero=h4.5.1
All of the following
QNAP Hybrid Backup Sync<16.0.0419
QNAP QuTScloud>=c4.5.1<=c4.5.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade QNAP HBS 3 on QTS 4.3.3 to a version that resolves this vulnerability.

    Fixed in v3.0.210411
  2. Upgrade

    Upgrade QNAP HBS 3 on QTS 4.3.4 to a version that resolves this vulnerability.

    Fixed in v3.0.210411
  3. Upgrade

    Upgrade QNAP HBS 3 on QTS 4.3.6 to a version that resolves this vulnerability.

    Fixed in v3.0.210412
  4. Upgrade

    Upgrade QNAP HBS 3 on QTS 4.5.2 to a version that resolves this vulnerability.

    Fixed in v16.0.0415
  5. Upgrade

    Upgrade QNAP HBS 3 on QuTS hero h4.5.1 to a version that resolves this vulnerability.

    Fixed in v16.0.0419
  6. Upgrade

    Upgrade QNAP HBS 3 on QuTScloud c4.5.1~c4.5.4 to a version that resolves this vulnerability.

    Fixed in v16.0.0419

Event History

May 13, 2021
CVE Published
via MITRE·02:55 AM
Data Sourced
via MITRE·02:55 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:15 AM
DescriptionSeverityWeaknessAffected Software
Mar 31, 2022
Known Exploited
via CISA·12:00 AM
Known Ransomware
via CISA·12:00 AM
Oct 29, 2024
News Published
via BleepingComputer·05:35 PM
News Published
via BleepingComputer·05:36 PM

Frequently Asked Questions

1

What is CVE-2021-28799?

CVE-2021-28799 is an improper authorization vulnerability affecting QNAP NAS running HBS 3 (Hybrid Backup Sync).

2

How does CVE-2021-28799 impact QNAP NAS?

If exploited, CVE-2021-28799 allows remote attackers to log in to a device.

3

Which versions of QNAP HBS 3 are affected by CVE-2021-28799?

CVE-2021-28799 affects QNAP HBS 3 versions prior to v16.0.0415.

4

Are the QNAP QTS versions vulnerable to CVE-2021-28799 as well?

QNAP QTS versions are not vulnerable to CVE-2021-28799.

5

How severe is CVE-2021-28799?

CVE-2021-28799 has a severity rating of 9.8 (critical).

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203