What’s Vulnerable › Vulnerabilities

CVE-2021-28799: QNAP NAS Improper Authorization Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-03-31
• EPSS: 78.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-05-13 · updated 2026-06-17
• Weakness: CWE-285

Description

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

Affected products

• QNAP Systems Inc. HBS 3 Hybrid Backup Sync: before 16.0.0415; before 3.0.210412; before 3.0.210411; before 16.0.0419 — fixed in 16.0.0415, 16.0.0419, 3.0.210411, 3.0.210412

How to fix

Upgrade to a fixed version: QNAP Systems Inc. HBS 3 Hybrid Backup Sync 16.0.0415, 16.0.0419, 3.0.210411, 3.0.210412. Check the vendor advisory for mitigations.

References

• https://www.qnap.com/en/security-advisory/QSA-21-13
• https://www.qnap.com/en/security-advisory/QSA-21-13
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799

Get alerted when CVE-2021-28799 or the next vulnerability affects your stack