CVE-2021-28799 - Vulnerability Details - OpenCVE

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is in the KEV database since March 31, 2022.

The EPSS score is 0.88768.

Exploitation active

Automatable yes

Technical Impact total

Vendors	Products
Qnap	Hybrid Backup Sync Qts Quts Hero Qutscloud

Configuration 1 [-]

AND

cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*

cpe:2.3:a:qnap:qts:4.5.2:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*

OR	cpe:2.3:a:qnap:qts:4.3.3:::::::*
	cpe:2.3:a:qnap:qts:4.3.4:::::::*

Configuration 4 [-]

AND

cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.1:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*

cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

QNAP have already fixed this vulnerability in the following versions of HBS 3: QTS 4.5.2: HBS 3 v16.0.0415 and later QTS 4.3.6: HBS 3 v3.0.210412 and later QTS 4.3.3 and 4.3.4: HBS 3 v3.0.210411 and later QuTS hero h4.5.1: HBS 3 v16.0.0419 and later QuTScloud c4.5.1~c4.5.4: HBS 3 v16.0.0419 and later

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799
https://www.qnap.com/en/security-advisory/QSA-21-13

History

Tue, 21 Oct 2025 19:30:00 +0000

Type	Values Removed	Values Added
References		https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799

Tue, 04 Feb 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		kev `{'dateAdded': '2022-03-31'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: qnap

Published: 2021-05-13T02:55:13.827Z

Updated: 2025-10-21T19:46:43.847Z

Reserved: 2021-03-18T00:00:00.000Z

Link: CVE-2021-28799

Vulnrichment

Updated: 2024-08-03T21:55:11.685Z

NVD

Status : Modified

Published: 2021-05-13T03:15:06.843

Modified: 2025-10-21T19:19:00.447

Link: CVE-2021-28799

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"platforms": ["QTS 4.5.2"], "product": "HBS 3", "vendor": "QNAP Systems Inc.", "versions": [{"lessThan": "v16.0.0415", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"platforms": ["QTS 4.3.6"], "product": "HBS 3", "vendor": "QNAP Systems Inc.", "versions": [{"lessThan": "v3.0.210412", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"platforms": ["QTS 4.3.4"], "product": "HBS 3", "vendor": "QNAP Systems Inc.", "versions": [{"lessThan": "v3.0.210411", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"platforms": ["QTS 4.3.3"], "product": "HBS 3", "vendor": "QNAP Systems Inc.", "versions": [{"lessThan": "v3.0.210411", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"platforms": ["QuTS hero h4.5.1"], "product": "HBS 3", "vendor": "QNAP Systems Inc.", "versions": [{"lessThan": "v16.0.0419", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"platforms": ["QuTScloud c4.5.1~c4.5.4"], "product": "HBS 3", "vendor": "QNAP Systems Inc.", "versions": [{"lessThan": "v16.0.0419", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "HBS 2", "vendor": "QNAP Systems Inc.", "versions": [{"status": "unaffected", "version": "all versions"}]}, {"product": "HBS 1.3", "vendor": "QNAP Systems Inc.", "versions": [{"status": "unaffected", "version": "all versions"}]}], "credits": [{"lang": "en", "value": "ZUSO ART"}], "datePublic": "2021-04-22T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 ."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "description": "CWE-285 Improper Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-05-13T02:55:13.000Z", "orgId": "2fd009eb-170a-4625-932b-17a53af1051f", "shortName": "qnap"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"}], "solutions": [{"lang": "en", "value": "QNAP have already fixed this vulnerability in the following versions of HBS 3:\nQTS 4.5.2: HBS 3 v16.0.0415 and later\nQTS 4.3.6: HBS 3 v3.0.210412 and later\nQTS 4.3.3 and 4.3.4: HBS 3 v3.0.210411 and later\nQuTS hero h4.5.1: HBS 3 v16.0.0419 and later\nQuTScloud c4.5.1~c4.5.4: HBS 3 v16.0.0419 and later"}], "source": {"advisory": "QSA-21-13", "discovery": "EXTERNAL"}, "title": "Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@qnap.com", "DATE_PUBLIC": "2021-04-22T00:54:00.000Z", "ID": "CVE-2021-28799", "STATE": "PUBLIC", "TITLE": "Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "HBS 3", "version": {"version_data": [{"platform": "QTS 4.5.2", "version_affected": "<", "version_value": "v16.0.0415"}, {"platform": "QTS 4.3.6", "version_affected": "<", "version_value": "v3.0.210412"}, {"platform": "QTS 4.3.4", "version_affected": "<", "version_value": "v3.0.210411"}, {"platform": "QTS 4.3.3", "version_affected": "<", "version_value": "v3.0.210411"}, {"platform": "QuTS hero h4.5.1", "version_affected": "<", "version_value": "v16.0.0419"}, {"platform": "QuTScloud c4.5.1~c4.5.4", "version_affected": "<", "version_value": "v16.0.0419"}]}}, {"product_name": "HBS 2", "version": {"version_data": [{"version_affected": "!", "version_value": "all versions"}]}}, {"product_name": "HBS 1.3", "version": {"version_data": [{"version_affected": "!", "version_value": "all versions"}]}}]}, "vendor_name": "QNAP Systems Inc."}]}}, "credit": [{"lang": "eng", "value": "ZUSO ART"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 ."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-285 Improper Authorization"}]}]}, "references": {"reference_data": [{"name": "https://www.qnap.com/en/security-advisory/QSA-21-13", "refsource": "MISC", "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"}]}, "solution": [{"lang": "en", "value": "QNAP have already fixed this vulnerability in the following versions of HBS 3:\nQTS 4.5.2: HBS 3 v16.0.0415 and later\nQTS 4.3.6: HBS 3 v3.0.210412 and later\nQTS 4.3.3 and 4.3.4: HBS 3 v3.0.210411 and later\nQuTS hero h4.5.1: HBS 3 v16.0.0419 and later\nQuTScloud c4.5.1~c4.5.4: HBS 3 v16.0.0419 and later"}], "source": {"advisory": "QSA-21-13", "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T21:55:11.685Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-28799", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-04T14:53:29.275519Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2022-03-31", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799"}}}], "timeline": [{"time": "2022-03-31T00:00:00+00:00", "lang": "en", "value": "CVE-2021-28799 added to CISA KEV"}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-21T19:46:43.847Z"}}]}, "cveMetadata": {"assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f", "assignerShortName": "qnap", "cveId": "CVE-2021-28799", "datePublished": "2021-05-13T02:55:13.827Z", "dateReserved": "2021-03-18T00:00:00.000Z", "dateUpdated": "2025-10-21T19:46:43.847Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.qnap.com/en/security-advisory/QSA-21-13", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T21:55:11.685Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-28799", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-04T14:53:29.275519Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2022-03-31", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-28799"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-04T14:53:59.832Z"}}], "cna": {"title": "Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)", "source": {"advisory": "QSA-21-13", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "value": "ZUSO ART"}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "QNAP Systems Inc.", "product": "HBS 3", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "v16.0.0415", "versionType": "custom"}], "platforms": ["QTS 4.5.2"]}, {"vendor": "QNAP Systems Inc.", "product": "HBS 3", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "v3.0.210412", "versionType": "custom"}], "platforms": ["QTS 4.3.6"]}, {"vendor": "QNAP Systems Inc.", "product": "HBS 3", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "v3.0.210411", "versionType": "custom"}], "platforms": ["QTS 4.3.4"]}, {"vendor": "QNAP Systems Inc.", "product": "HBS 3", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "v3.0.210411", "versionType": "custom"}], "platforms": ["QTS 4.3.3"]}, {"vendor": "QNAP Systems Inc.", "product": "HBS 3", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "v16.0.0419", "versionType": "custom"}], "platforms": ["QuTS hero h4.5.1"]}, {"vendor": "QNAP Systems Inc.", "product": "HBS 3", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "v16.0.0419", "versionType": "custom"}], "platforms": ["QuTScloud c4.5.1~c4.5.4"]}, {"vendor": "QNAP Systems Inc.", "product": "HBS 2", "versions": [{"status": "unaffected", "version": "all versions"}]}, {"vendor": "QNAP Systems Inc.", "product": "HBS 1.3", "versions": [{"status": "unaffected", "version": "all versions"}]}], "solutions": [{"lang": "en", "value": "QNAP have already fixed this vulnerability in the following versions of HBS 3:\nQTS 4.5.2: HBS 3 v16.0.0415 and later\nQTS 4.3.6: HBS 3 v3.0.210412 and later\nQTS 4.3.3 and 4.3.4: HBS 3 v3.0.210411 and later\nQuTS hero h4.5.1: HBS 3 v16.0.0419 and later\nQuTScloud c4.5.1~c4.5.4: HBS 3 v16.0.0419 and later"}], "datePublic": "2021-04-22T00:00:00.000Z", "references": [{"url": "https://www.qnap.com/en/security-advisory/QSA-21-13", "tags": ["x_refsource_MISC"]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 ."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285 Improper Authorization"}]}], "providerMetadata": {"orgId": "2fd009eb-170a-4625-932b-17a53af1051f", "shortName": "qnap", "dateUpdated": "2021-05-13T02:55:13.000Z"}, "x_legacyV4Record": {"credit": [{"lang": "eng", "value": "ZUSO ART"}], "impact": {"cvss": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, "source": {"advisory": "QSA-21-13", "discovery": "EXTERNAL"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"platform": "QTS 4.5.2", "version_value": "v16.0.0415", "version_affected": "<"}, {"platform": "QTS 4.3.6", "version_value": "v3.0.210412", "version_affected": "<"}, {"platform": "QTS 4.3.4", "version_value": "v3.0.210411", "version_affected": "<"}, {"platform": "QTS 4.3.3", "version_value": "v3.0.210411", "version_affected": "<"}, {"platform": "QuTS hero h4.5.1", "version_value": "v16.0.0419", "version_affected": "<"}, {"platform": "QuTScloud c4.5.1~c4.5.4", "version_value": "v16.0.0419", "version_affected": "<"}]}, "product_name": "HBS 3"}, {"version": {"version_data": [{"version_value": "all versions", "version_affected": "!"}]}, "product_name": "HBS 2"}, {"version": {"version_data": [{"version_value": "all versions", "version_affected": "!"}]}, "product_name": "HBS 1.3"}]}, "vendor_name": "QNAP Systems Inc."}]}}, "solution": [{"lang": "en", "value": "QNAP have already fixed this vulnerability in the following versions of HBS 3:\nQTS 4.5.2: HBS 3 v16.0.0415 and later\nQTS 4.3.6: HBS 3 v3.0.210412 and later\nQTS 4.3.3 and 4.3.4: HBS 3 v3.0.210411 and later\nQuTS hero h4.5.1: HBS 3 v16.0.0419 and later\nQuTScloud c4.5.1~c4.5.4: HBS 3 v16.0.0419 and later"}], "data_type": "CVE", "generator": {"engine": "Vulnogram 0.0.9"}, "references": {"reference_data": [{"url": "https://www.qnap.com/en/security-advisory/QSA-21-13", "name": "https://www.qnap.com/en/security-advisory/QSA-21-13", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 ."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-285 Improper Authorization"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2021-28799", "STATE": "PUBLIC", "TITLE": "Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)", "ASSIGNER": "security@qnap.com", "DATE_PUBLIC": "2021-04-22T00:54:00.000Z"}}}}, "cveMetadata": {"cveId": "CVE-2021-28799", "state": "PUBLISHED", "dateUpdated": "2025-02-04T15:03:30.646Z", "dateReserved": "2021-03-18T00:00:00.000Z", "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f", "datePublished": "2021-05-13T02:55:13.827Z", "assignerShortName": "qnap"}, "dataVersion": "5.1"}

{"cisaActionDue": "2022-04-21", "cisaExploitAdd": "2022-03-31", "cisaRequiredAction": "Apply updates per vendor instructions.", "cisaVulnerabilityName": "QNAP NAS Improper Authorization Vulnerability", "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*", "matchCriteriaId": "A18656F9-AFB4-44BC-AF08-E1A0A5D2EF49", "versionEndExcluding": "16.0.0415", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:qnap:qts:4.5.2:*:*:*:*:*:*:*", "matchCriteriaId": "FDCF1153-3508-4BF6-ADC8-ADDCB2E2235C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*", "matchCriteriaId": "D5920EA4-EEA5-4F64-B06B-EED06E824864", "versionEndExcluding": "3.0.210412", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*", "matchCriteriaId": "FE9FAC96-AA2A-4CA5-A170-8C0E6BD47391", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*", "matchCriteriaId": "78491B95-5835-411B-B188-30E496BCB10A", "versionEndExcluding": "3.0.210411", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:qnap:qts:4.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "2E534876-EFBD-4C85-B2C3-DA5CF07574CA", "vulnerable": false}, {"criteria": "cpe:2.3:a:qnap:qts:4.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "7AC043EF-7BDF-4324-BF07-323C10BE98A3", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*", "matchCriteriaId": "BB2A5649-4BB9-46E9-8A1A-B6046125BD92", "versionEndExcluding": "16.0.0419", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:qnap:quts_hero:h4.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "548228B3-EB2C-42C1-895B-DA6DC5CA26EE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*", "matchCriteriaId": "BB2A5649-4BB9-46E9-8A1A-B6046125BD92", "versionEndExcluding": "16.0.0419", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*", "matchCriteriaId": "FEDF704D-D5AD-45C2-AD7D-E53189C72E1A", "versionEndIncluding": "c4.5.4", "versionStartIncluding": "c4.5.1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 ."}, {"lang": "es", "value": "Se ha reportado una vulnerabilidad de autorizaci\u00f3n inapropiada que afecta al QNAP NAS que ejecuta HBS versi\u00f3n 3 (Hybrid Backup Sync). Si es explotada, la vulnerabilidad permite a atacantes remotos iniciar sesi\u00f3n en un dispositivo. Este problema afecta a: QNAP Systems Inc. HBS 3 versiones anteriores a v16.0.0415 en QTS versi\u00f3n 4.5.2; versiones anteriores a v3.0.210412 en QTS versi\u00f3n 4.3.6; versiones anteriores a v3.0.210411 en QTS versi\u00f3n 4.3.4; versiones anteriores a v3.0.210411 en QTS versi\u00f3n 4.3.3; versiones anteriores a 16.0.0419 en QuTS hero versiones h4.5.1; anterior a versi\u00f3n v16.0.0419 en QuTScloud versiones c4.5.1~c4.5.4. Este problema no afecta a: QNAP Systems Inc. HBS versi\u00f3n 2. QNAP Systems Inc. HBS versi\u00f3n 1.3"}], "id": "CVE-2021-28799", "lastModified": "2025-10-21T19:19:00.447", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "security@qnapsecurity.com.tw", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-05-13T03:15:06.843", "references": [{"source": "security@qnapsecurity.com.tw", "tags": ["Vendor Advisory"], "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799"}], "sourceIdentifier": "security@qnapsecurity.com.tw", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "security@qnapsecurity.com.tw", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}