QNAP · Network Attached Storage (NAS)
CVE-2021-28799
Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)
What it is
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .
CISA: QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: April 21, 2022
- Added to the CISA list
- March 31, 2022
- Published
- May 13, 2021
- Severity
- Critical 10.0 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 78% in the top 0.4% of all known vulnerabilities
- Weakness
- CWE-285
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from QNAP
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 24, 2022 | NAS File Station Cross-Site Scripting | Network Attached Storage (NAS) | High 8.0 | 23% |
| May 24, 2022 | NAS File Station Command Injection | Network Attached Storage (NAS) | Critical 9.8 | 30% |
| May 24, 2022 | NAS File Station Cross-Site Scripting | Network Attached Storage (NAS) | Medium 6.1 | 31% |
| Dec 21, 2023 | OS Command Injection | VioStor NVR | High 8.0 | 73% |
| Sep 8, 2022 | Externally Controlled Reference | Photo Station | Critical 10.0 | 88% |
| Jun 8, 2022 | Improper Access Control | Photo Station | Critical 9.8 | 88% |
| Jun 8, 2022 | Improper Input Validation | QTS | Critical 9.8 | 14% |
| Jun 8, 2022 | Path Traversal | Photo Station | Critical 9.8 | 83% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.