Actively exploited · Published May 13, 2021 · Assigned by qnap

CVE-2021-28799Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)

Critical 10.0 Exploited Ransomware

In plain English

A critical-severity security flaw in HBS 1.3 from QNAP Systems Inc.. Attackers are actively exploiting it in the wild (listed by CISA on March 31, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 78.2% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Apply updates per vendor instructions.

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)78.2%top 0.4% of all CVEs

Exploited in the wildYesCISA KEV since Mar 31, 2022

Attack tooling1Nuclei

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 21, 2022.

Official description

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

Affected products (as reported)

Vendor	Product	Versions
QNAP Systems Inc.	HBS 3	unspecified – before v16.0.0415
QNAP Systems Inc.	HBS 3	unspecified – before v3.0.210412
QNAP Systems Inc.	HBS 3	unspecified – before v3.0.210411
QNAP Systems Inc.	HBS 3	unspecified – before v3.0.210411
QNAP Systems Inc.	HBS 3	unspecified – before v16.0.0419
QNAP Systems Inc.	HBS 3	unspecified – before v16.0.0419
QNAP Systems Inc.	HBS 2	see references
QNAP Systems Inc.	HBS 1.3	see references

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://www.qnap.com/en/security-advisory/QSA-21-13 x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799 government-resource