Vulnerability Intelligence Report
Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)
CVE-2021-28799
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .
CISA KEV
Nuclei Template
SSVC: Active Exploitation
Automatable
CVSS Base Score
10.0
CRITICAL
Exploitability:3.9
Impact Score:6.1
EPSS Probability:78.40%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-285 ↗CWE-285 Improper Authorization
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| QNAP Systems Inc. | HBS 3 | unspecified < v16.0.0415 (affected) |
| QNAP Systems Inc. | HBS 3 | unspecified < v3.0.210412 (affected) |
| QNAP Systems Inc. | HBS 3 | unspecified < v3.0.210411 (affected) |
| QNAP Systems Inc. | HBS 3 | unspecified < v3.0.210411 (affected) |
| QNAP Systems Inc. | HBS 3 | unspecified < v16.0.0419 (affected) |
| QNAP Systems Inc. | HBS 3 | unspecified < v16.0.0419 (affected) |
| QNAP Systems Inc. | HBS 2 | all versions (unaffected) |
| QNAP Systems Inc. | HBS 1.3 | all versions (unaffected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
Nuclei Template
SCANNER AVAILABLE
EPSS Score
78.395%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | QNAP Systems, Inc. · Vendor · Taiwan |
| Reserved | 2021-03-18T00:00:00 |
| Published | 2021-05-13T02:55:13 |
| Patch Date | 2021-04-22 |
| Last Updated | 2025-10-21T23:25:45 |
Community Chatter & Buzz