CVE-2021-28799

CriticalActively exploited (CISA KEV)Known to be used in ransomware campaigns

Description

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

SeverityCritical

CVSS10.0

Exploit probability100. percentile78.3%

Product

QNAP Network Attached Storage (NAS)

PublishedMay 13, 2021

First seenMay 13, 2021

Added to KEVMar 31, 2022

Weakness typeCWE-285CWE-285

How to fix

CISA required action

Apply updates per vendor instructions.

CISA due date: Apr 21, 2022

Update

qnap hybrid_backup_sync16.0.0415, 3.0.210412, 3.0.210411, 16.0.0419 or later

Affected products

Product	Affected versions	Fixed in
qnap hybrid_backup_sync	v < 16.0.0415, v < 3.0.210412, v < 3.0.210411, v < 16.0.0419	16.0.0415, 3.0.210412, 3.0.210411, 16.0.0419

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.