Vulnerability-Lookup

CVE-2021-28799 (GCVE-0-2021-28799)

Vulnerability from cvelistv5 – Published: 2021-05-13 02:55 – Updated: 2025-10-21 23:25

CISA Shadowserver Previdian

Title

Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)

Summary

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: active Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-04 14:53 UTC

CWE

CWE-285 - Improper Authorization

Assigner

qnap mitre root

References

2 references

URL	Tags
https://www.qnap.com/en/security-advisory/QSA-21-13	x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

6 products

Vendor	Product	Version	CPE status
QNAP Systems Inc.	HBS 3	Affected: unspecified , < v16.0.0415 (custom)	guessed
QNAP Systems Inc.	HBS 3	Affected: unspecified , < v3.0.210412 (custom)	guessed
QNAP Systems Inc.	HBS 3	Affected: unspecified , < v3.0.210411 (custom)	guessed
QNAP Systems Inc.	HBS 3	Affected: unspecified , < v16.0.0419 (custom)	guessed
QNAP Systems Inc.	HBS 2	Unaffected: all versions	guessed
QNAP Systems Inc.	HBS 1.3	Unaffected: all versions	guessed

Date Public

2021-04-22 00:00

Credits

ZUSO ART

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 44af985b-d20e-455b-9dfe-84f7d67cd38a

Vulnerability ID: CVE-2021-28799

Status: Confirmed

Status Updated: 2022-03-31 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2022-03-31

Asserted: 2022-03-31

Scope

Notes: KEV entry: QNAP NAS Improper Authorization Vulnerability | Affected: QNAP / Network Attached Storage (NAS) | Description: QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device. | Required action: Apply updates per vendor instructions. | Due date: 2022-04-21 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-28799

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-285
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	Network Attached Storage (NAS)
Due Date	2022-04-21
Date Added	2022-03-31
Vendorproject	QNAP
Vulnerabilityname	QNAP NAS Improper Authorization Vulnerability
Knownransomwarecampaignuse	Known

References

CVE-2021-28799

Created: 2026-02-02 13:25 UTC | Updated: 2026-02-06 07:53 UTC

Shadowserver

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 2cd11be5-9f58-4029-adab-a8cbb5834710

Vulnerability ID: CVE-2021-28799

Status: Confirmed

Status Updated: 2026-09-07 00:00 UTC

Exploited: Yes

Characteristics

Severity: 98.0

Timestamps

First Seen: 2026-01-14

Asserted: 2026-01-14

Last Seen: 2026-09-07

Scope

Asset Exposure: ['internet-facing']

Evidence

Type: Honeypot

Signal: In The Wild Attempts

Confidence: 70%

Source: shadowserver

Details

1D	1
Iot	yes
Feed	Shadowserver Foundation honeypot/exploited-vulnerabilities
Type	http-scan
Class	nas
7D Avg	2
Vendor	QNAP
30D Avg	1
90D Avg	1
Product	QNAP NAS running HBS 3
Cisa Kev	yes
Connections	3
Observation Date	2026-09-07
Vulnerability Class	CVSS
Vulnerability Score	9.8
Vulnerability Severity	Critical

References

Created: 2026-07-01 05:54 UTC | Updated: 2026-09-09 01:00 UTC

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: b6bf6b23-c149-46f0-988a-2577c076c610

Vulnerability ID: CVE-2021-28799

Status: Confirmed

Status Updated: 2022-03-31 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2022-03-31

Asserted: 2022-03-31

Scope

Notes: KEVIntel entry: Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync) | Affected: QNAP Systems Inc. / HBS 3, HBS 2, HBS 1.3 | CVSS: 10.0 (CRITICAL) | Used in malware: yes | Not yet in CISA KEV: False

Evidence

Type: Public Report

Signal: Confirmed Compromise

Confidence: 70%

Source: kevintel

Details

Feed	KEVIntel (kevintel.com)
Title	Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)
Vendor	QNAP Systems Inc.
Product	HBS 3, HBS 2, HBS 1.3
Added Date	2022-03-31T00:00:00.000Z
Cvss Score	10.0
Epss Score	None
Cvss Severity	CRITICAL
Epss Percentile	None
Used In Malware	yes
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	False

References

Created: 2026-06-23 11:13 UTC | Updated: 2026-06-23 11:13 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T21:55:11.685Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-28799",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T14:53:29.275519Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2022-03-31",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:25:45.551Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2022-03-31T00:00:00.000Z",
            "value": "CVE-2021-28799 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "QTS 4.5.2"
          ],
          "product": "HBS 3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "v16.0.0415",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "QTS 4.3.6"
          ],
          "product": "HBS 3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "v3.0.210412",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "QTS 4.3.4"
          ],
          "product": "HBS 3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "v3.0.210411",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "QTS 4.3.3"
          ],
          "product": "HBS 3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "v3.0.210411",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "QuTS hero h4.5.1"
          ],
          "product": "HBS 3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "v16.0.0419",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "QuTScloud c4.5.1~c4.5.4"
          ],
          "product": "HBS 3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "v16.0.0419",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "HBS 2",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "status": "unaffected",
              "version": "all versions"
            }
          ]
        },
        {
          "product": "HBS 1.3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "status": "unaffected",
              "version": "all versions"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "ZUSO ART"
        }
      ],
      "datePublic": "2021-04-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 ."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-13T02:55:13.000Z",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "QNAP have already fixed this vulnerability in the following versions of HBS 3:\nQTS 4.5.2: HBS 3 v16.0.0415 and later\nQTS 4.3.6: HBS 3 v3.0.210412 and later\nQTS 4.3.3 and 4.3.4: HBS 3 v3.0.210411 and later\nQuTS hero h4.5.1: HBS 3 v16.0.0419 and later\nQuTScloud c4.5.1~c4.5.4: HBS 3 v16.0.0419 and later"
        }
      ],
      "source": {
        "advisory": "QSA-21-13",
        "discovery": "EXTERNAL"
      },
      "title": "Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@qnap.com",
          "DATE_PUBLIC": "2021-04-22T00:54:00.000Z",
          "ID": "CVE-2021-28799",
          "STATE": "PUBLIC",
          "TITLE": "Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "HBS 3",
                      "version": {
                        "version_data": [
                          {
                            "platform": "QTS 4.5.2",
                            "version_affected": "\u003c",
                            "version_value": "v16.0.0415"
                          },
                          {
                            "platform": "QTS 4.3.6",
                            "version_affected": "\u003c",
                            "version_value": "v3.0.210412"
                          },
                          {
                            "platform": "QTS 4.3.4",
                            "version_affected": "\u003c",
                            "version_value": "v3.0.210411"
                          },
                          {
                            "platform": "QTS 4.3.3",
                            "version_affected": "\u003c",
                            "version_value": "v3.0.210411"
                          },
                          {
                            "platform": "QuTS hero h4.5.1",
                            "version_affected": "\u003c",
                            "version_value": "v16.0.0419"
                          },
                          {
                            "platform": "QuTScloud c4.5.1~c4.5.4",
                            "version_affected": "\u003c",
                            "version_value": "v16.0.0419"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "HBS 2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "!",
                            "version_value": "all versions"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "HBS 1.3",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "!",
                            "version_value": "all versions"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "QNAP Systems Inc."
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "ZUSO ART"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 ."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285 Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qnap.com/en/security-advisory/QSA-21-13",
              "refsource": "MISC",
              "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "QNAP have already fixed this vulnerability in the following versions of HBS 3:\nQTS 4.5.2: HBS 3 v16.0.0415 and later\nQTS 4.3.6: HBS 3 v3.0.210412 and later\nQTS 4.3.3 and 4.3.4: HBS 3 v3.0.210411 and later\nQuTS hero h4.5.1: HBS 3 v16.0.0419 and later\nQuTScloud c4.5.1~c4.5.4: HBS 3 v16.0.0419 and later"
          }
        ],
        "source": {
          "advisory": "QSA-21-13",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2021-28799",
    "datePublished": "2021-05-13T02:55:13.827Z",
    "dateReserved": "2021-03-18T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:25:45.551Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2021-28799",
      "cwes": [
        "CWE-285"
      ],
      "dateAdded": "2022-03-31",
      "dueDate": "2022-04-21",
      "forensicTriage": "No",
      "knownRansomwareCampaignUse": "Known",
      "notes": "https://nvd.nist.gov/vuln/detail/CVE-2021-28799",
      "product": "Network Attached Storage (NAS)",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.",
      "vendorProject": "QNAP",
      "vulnerabilityName": "QNAP NAS Improper Authorization Vulnerability"
    },
    "epss": {
      "cve": "CVE-2021-28799",
      "date": "2026-09-20",
      "epss": "0.7825",
      "percentile": "0.99556"
    },
    "nvd": {
      "cve": {
        "cisaActionDue": "2022-04-21",
        "cisaExploitAdd": "2022-03-31",
        "cisaRequiredAction": "Apply updates per vendor instructions.",
        "cisaVulnerabilityName": "QNAP NAS Improper Authorization Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A18656F9-AFB4-44BC-AF08-E1A0A5D2EF49",
                    "versionEndExcluding": "16.0.0415",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.5.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1AC8BD83-EA71-4AF8-AAEC-E46EFCA99EA2",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D5920EA4-EEA5-4F64-B06B-EED06E824864",
                    "versionEndExcluding": "3.0.210412",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FE9FAC96-AA2A-4CA5-A170-8C0E6BD47391",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "78491B95-5835-411B-B188-30E496BCB10A",
                    "versionEndExcluding": "3.0.210411",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C5994C07-17FE-4784-9FA4-9675BA8B4743",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F0C7D2D4-769F-4297-89F4-75366FFA7618",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BB2A5649-4BB9-46E9-8A1A-B6046125BD92",
                    "versionEndExcluding": "16.0.0419",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:qnap:quts_hero:h4.5.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "548228B3-EB2C-42C1-895B-DA6DC5CA26EE",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BB2A5649-4BB9-46E9-8A1A-B6046125BD92",
                    "versionEndExcluding": "16.0.0419",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FEDF704D-D5AD-45C2-AD7D-E53189C72E1A",
                    "versionEndIncluding": "c4.5.4",
                    "versionStartIncluding": "c4.5.1",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 ."
          },
          {
            "lang": "es",
            "value": "Se ha reportado una vulnerabilidad de autorizaci\u00f3n inapropiada que afecta al QNAP NAS que ejecuta HBS versi\u00f3n 3 (Hybrid Backup Sync). Si es explotada, la vulnerabilidad permite a atacantes remotos iniciar sesi\u00f3n en un dispositivo. Este problema afecta a: QNAP Systems Inc. HBS 3 versiones anteriores a v16.0.0415 en QTS versi\u00f3n 4.5.2; versiones anteriores a v3.0.210412 en QTS versi\u00f3n 4.3.6; versiones anteriores a v3.0.210411 en QTS versi\u00f3n 4.3.4; versiones anteriores a v3.0.210411 en QTS versi\u00f3n 4.3.3; versiones anteriores a 16.0.0419 en QuTS hero versiones h4.5.1; anterior a versi\u00f3n v16.0.0419 en QuTScloud versiones c4.5.1~c4.5.4. Este problema no afecta a: QNAP Systems Inc. HBS versi\u00f3n 2. QNAP Systems Inc. HBS versi\u00f3n 1.3"
          }
        ],
        "id": "CVE-2021-28799",
        "lastModified": "2025-11-03T15:07:48.747",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 7.5,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 10.0,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 6.0,
              "source": "security@qnapsecurity.com.tw",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2021-05-13T03:15:06.843",
        "references": [
          {
            "source": "security@qnapsecurity.com.tw",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "US Government Resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799"
          }
        ],
        "sourceIdentifier": "security@qnapsecurity.com.tw",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-285"
              }
            ],
            "source": "security@qnapsecurity.com.tw",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-Other"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T14:20:27+00:00",
      "cve": "CVE-2021-28799",
      "id": "CVE-2021-28799",
      "initial_release_date": "2021-04-22T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-28799.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-03T21:55:11.685Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-28799",
                    "options": [
                      {
                        "Exploitation": "active"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-02-04T14:53:29.275519Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              },
              {
                "other": {
                  "content": {
                    "dateAdded": "2022-03-31",
                    "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799"
                  },
                  "type": "kev"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-02-04T14:53:59.832Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "government-resource"
                ],
                "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799"
              }
            ],
            "timeline": [
              {
                "lang": "en",
                "time": "2022-03-31T00:00:00.000Z",
                "value": "CVE-2021-28799 added to CISA KEV"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "platforms": [
                "QTS 4.5.2"
              ],
              "product": "HBS 3",
              "vendor": "QNAP Systems Inc.",
              "versions": [
                {
                  "lessThan": "v16.0.0415",
                  "status": "affected",
                  "version": "unspecified",
                  "versionType": "custom"
                }
              ]
            },
            {
              "platforms": [
                "QTS 4.3.6"
              ],
              "product": "HBS 3",
              "vendor": "QNAP Systems Inc.",
              "versions": [
                {
                  "lessThan": "v3.0.210412",
                  "status": "affected",
                  "version": "unspecified",
                  "versionType": "custom"
                }
              ]
            },
            {
              "platforms": [
                "QTS 4.3.4"
              ],
              "product": "HBS 3",
              "vendor": "QNAP Systems Inc.",
              "versions": [
                {
                  "lessThan": "v3.0.210411",
                  "status": "affected",
                  "version": "unspecified",
                  "versionType": "custom"
                }
              ]
            },
            {
              "platforms": [
                "QTS 4.3.3"
              ],
              "product": "HBS 3",
              "vendor": "QNAP Systems Inc.",
              "versions": [
                {
                  "lessThan": "v3.0.210411",
                  "status": "affected",
                  "version": "unspecified",
                  "versionType": "custom"
                }
              ]
            },
            {
              "platforms": [
                "QuTS hero h4.5.1"
              ],
              "product": "HBS 3",
              "vendor": "QNAP Systems Inc.",
              "versions": [
                {
                  "lessThan": "v16.0.0419",
                  "status": "affected",
                  "version": "unspecified",
                  "versionType": "custom"
                }
              ]
            },
            {
              "platforms": [
                "QuTScloud c4.5.1~c4.5.4"
              ],
              "product": "HBS 3",
              "vendor": "QNAP Systems Inc.",
              "versions": [
                {
                  "lessThan": "v16.0.0419",
                  "status": "affected",
                  "version": "unspecified",
                  "versionType": "custom"
                }
              ]
            },
            {
              "product": "HBS 2",
              "vendor": "QNAP Systems Inc.",
              "versions": [
                {
                  "status": "unaffected",
                  "version": "all versions"
                }
              ]
            },
            {
              "product": "HBS 1.3",
              "vendor": "QNAP Systems Inc.",
              "versions": [
                {
                  "status": "unaffected",
                  "version": "all versions"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "ZUSO ART"
            }
          ],
          "datePublic": "2021-04-22T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 ."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 10,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-285",
                  "description": "CWE-285 Improper Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2021-05-13T02:55:13.000Z",
            "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
            "shortName": "qnap"
          },
          "references": [
            {
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "QNAP have already fixed this vulnerability in the following versions of HBS 3:\nQTS 4.5.2: HBS 3 v16.0.0415 and later\nQTS 4.3.6: HBS 3 v3.0.210412 and later\nQTS 4.3.3 and 4.3.4: HBS 3 v3.0.210411 and later\nQuTS hero h4.5.1: HBS 3 v16.0.0419 and later\nQuTScloud c4.5.1~c4.5.4: HBS 3 v16.0.0419 and later"
            }
          ],
          "source": {
            "advisory": "QSA-21-13",
            "discovery": "EXTERNAL"
          },
          "title": "Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)",
          "x_generator": {
            "engine": "Vulnogram 0.0.9"
          },
          "x_legacyV4Record": {
            "CVE_data_meta": {
              "ASSIGNER": "security@qnap.com",
              "DATE_PUBLIC": "2021-04-22T00:54:00.000Z",
              "ID": "CVE-2021-28799",
              "STATE": "PUBLIC",
              "TITLE": "Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)"
            },
            "affects": {
              "vendor": {
                "vendor_data": [
                  {
                    "product": {
                      "product_data": [
                        {
                          "product_name": "HBS 3",
                          "version": {
                            "version_data": [
                              {
                                "platform": "QTS 4.5.2",
                                "version_affected": "\u003c",
                                "version_value": "v16.0.0415"
                              },
                              {
                                "platform": "QTS 4.3.6",
                                "version_affected": "\u003c",
                                "version_value": "v3.0.210412"
                              },
                              {
                                "platform": "QTS 4.3.4",
                                "version_affected": "\u003c",
                                "version_value": "v3.0.210411"
                              },
                              {
                                "platform": "QTS 4.3.3",
                                "version_affected": "\u003c",
                                "version_value": "v3.0.210411"
                              },
                              {
                                "platform": "QuTS hero h4.5.1",
                                "version_affected": "\u003c",
                                "version_value": "v16.0.0419"
                              },
                              {
                                "platform": "QuTScloud c4.5.1~c4.5.4",
                                "version_affected": "\u003c",
                                "version_value": "v16.0.0419"
                              }
                            ]
                          }
                        },
                        {
                          "product_name": "HBS 2",
                          "version": {
                            "version_data": [
                              {
                                "version_affected": "!",
                                "version_value": "all versions"
                              }
                            ]
                          }
                        },
                        {
                          "product_name": "HBS 1.3",
                          "version": {
                            "version_data": [
                              {
                                "version_affected": "!",
                                "version_value": "all versions"
                              }
                            ]
                          }
                        }
                      ]
                    },
                    "vendor_name": "QNAP Systems Inc."
                  }
                ]
              }
            },
            "credit": [
              {
                "lang": "eng",
                "value": "ZUSO ART"
              }
            ],
            "data_format": "MITRE",
            "data_type": "CVE",
            "data_version": "4.0",
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 ."
                }
              ]
            },
            "generator": {
              "engine": "Vulnogram 0.0.9"
            },
            "impact": {
              "cvss": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 10,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              }
            },
            "problemtype": {
              "problemtype_data": [
                {
                  "description": [
                    {
                      "lang": "eng",
                      "value": "CWE-285 Improper Authorization"
                    }
                  ]
                }
              ]
            },
            "references": {
              "reference_data": [
                {
                  "name": "https://www.qnap.com/en/security-advisory/QSA-21-13",
                  "refsource": "MISC",
                  "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
                }
              ]
            },
            "solution": [
              {
                "lang": "en",
                "value": "QNAP have already fixed this vulnerability in the following versions of HBS 3:\nQTS 4.5.2: HBS 3 v16.0.0415 and later\nQTS 4.3.6: HBS 3 v3.0.210412 and later\nQTS 4.3.3 and 4.3.4: HBS 3 v3.0.210411 and later\nQuTS hero h4.5.1: HBS 3 v16.0.0419 and later\nQuTScloud c4.5.1~c4.5.4: HBS 3 v16.0.0419 and later"
              }
            ],
            "source": {
              "advisory": "QSA-21-13",
              "discovery": "EXTERNAL"
            }
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "assignerShortName": "qnap",
        "cveId": "CVE-2021-28799",
        "datePublished": "2021-05-13T02:55:13.827Z",
        "dateReserved": "2021-03-18T00:00:00.000Z",
        "dateUpdated": "2025-10-21T23:25:45.551Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2021-05089 (CVE-2021-28799)

Vulnerability from fstec – Published: 2021-10-21 – Updated: 2024-09-24 – View on bdu.fstec.ru Exploit exists Yes Fixed

CISA Shadowserver Previdian

Title

Уязвимость приложения для резервного копирования и аварийного восстановления данных HBS 3 (Hybrid Backup Sync) операционных систем QTS, связанная с недостатками контроля доступа, позволяющая нарушителю повысить свои привилегии

Summary

Уязвимость приложения для резервного копирования и аварийного восстановления данных HBS 3 (Hybrid Backup Sync) операционных систем QTS связана с недостатками контроля доступа. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, повысить свои привилегии

Severity

10.0 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 (Critical) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Authorization bypass

Incidents

Yes

Remediation

Software update

CWE

CWE-285 - Неправильная авторизация
CWE-863 - Неправильная авторизация

Aliases

CVE-2021-28799

References

2 references

URL
https://www.qnap.com/en/security-advisory/QSA-21-13
https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv

Impacted products

1 product from 2 vendors

Vendors

QNAP Systems, Inc.

Products

HBS 3 (Hybrid Backup Sync)

Versions

до 16.0.0415 (HBS 3 (Hybrid Backup Sync)), до 3.0.210412 (HBS 3 (Hybrid Backup Sync)), до 3.0.210411 (HBS 3 (Hybrid Backup Sync)), до 16.0.0419 (HBS 3 (Hybrid Backup Sync))

Product types

Application software

Platforms

QNAP Systems, Inc. QTS 4.3.6, Inc. QTS 4.3.4, Inc. QTS 4.3.3, Inc. QTS 4.5.2, Inc. QuTS hero 4.5.1, Inc. QuTScloud от c4.5.1 до c4.5.4 включительно

Mitigations

Использование рекомендаций: https://www.qnap.com/en/security-advisory/QSA-21-13

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "QNAP Systems, Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 16.0.0415 (HBS 3 (Hybrid Backup Sync)), \u0434\u043e 3.0.210412 (HBS 3 (Hybrid Backup Sync)), \u0434\u043e 3.0.210411 (HBS 3 (Hybrid Backup Sync)), \u0434\u043e 16.0.0419 (HBS 3 (Hybrid Backup Sync))",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://www.qnap.com/en/security-advisory/QSA-21-13",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "12.05.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "24.09.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "21.10.2021",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2021-05089",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2021-28799",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "HBS 3 (Hybrid Backup Sync)",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "QNAP Systems, Inc. QTS 4.3.6 , QNAP Systems, Inc. QTS 4.3.4 , QNAP Systems, Inc. QTS 4.3.3 , QNAP Systems, Inc. QTS 4.5.2 , QNAP Systems, Inc. QuTS hero 4.5.1 , QNAP Systems, Inc. QuTScloud \u043e\u0442 c4.5.1 \u0434\u043e c4.5.4 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e\u0433\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 HBS 3 (Hybrid Backup Sync) \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c QTS, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0430\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f (CWE-285), \u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0430\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f (CWE-863)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e\u0433\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 HBS 3 (Hybrid Backup Sync) \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c QTS \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.qnap.com/en/security-advisory/QSA-21-13\nhttps://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-285, CWE-863",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 10)\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 9,8)"
}

CERTFR-2021-AVI-307

Vulnerability from certfr_avis - Published: 2021-04-22 - Updated: 2021-04-22

Une vulnérabilité a été découverte dans QNAP HBS 3 Hybrid Backup Sync. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Qnap	Hybrid Backup Sync	HBS 3 Hybrid Backup Sync pour QuTScloud c4.5.x versions antérieures à 16.0.0419
Qnap	Hybrid Backup Sync	HBS 3 Hybrid Backup Sync pour QuTS hero h4.5.1 versions antérieures à 16.0.0419
Qnap	Hybrid Backup Sync	HBS 3 Hybrid Backup Sync pour QTS 4.5.2 versions antérieures à 16.0.0415
Qnap	Hybrid Backup Sync	HBS 3 Hybrid Backup Sync pour QTS 4.3.6 versions antérieures à 3.0.210412

References

Title

Publication Time

CERTFR-2021-AVI-334

Vulnerability from certfr_avis - Published: 2021-05-03 - Updated: 2021-05-03

Une vulnérabilité a été découverte dans Qnap QTS. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Qnap	QTS	HBS 3 Hybrid Backup Sync pour QTS 4.3.4 versions antérieures à 3.0.210411
Qnap	QTS	HBS 3 Hybrid Backup Sync pour QTS 4.3.6 versions antérieures à 3.0.210412
Qnap	QTS	HBS 3 Hybrid Backup Sync pour QTS 4.3.3 versions antérieures à 3.0.210411
Qnap	QTS	HBS 3 Hybrid Backup Sync pour QTS 4.5.2 versions antérieures à 16.0.0415

References

Title

Publication Time

CNVD-2021-31949

Vulnerability from cnvd - Published: 2021-04-30

Title

Qnap Systems QNAP HBS 3授权问题漏洞

Description

Qnap Systems QNAP HBS 3是中国威联通（Qnap Systems）公司的一个应用系统。一种全面的数据备份和灾难恢复解决方案。 HBS 3 Hybrid Backup Sync存在授权问题漏洞，该漏洞源于未能充分的授权检查。攻击者可利用该漏洞可以绕过授权检查，直接登录设备。

Severity

高

Patch Name

Qnap Systems QNAP HBS 3授权问题漏洞的补丁

Patch Description

Qnap Systems QNAP HBS 3是中国威联通（Qnap Systems）公司的一个应用系统。一种全面的数据备份和灾难恢复解决方案。 HBS 3 Hybrid Backup Sync存在授权问题漏洞，该漏洞源于未能充分的授权检查。攻击者可利用该漏洞可以绕过授权检查，直接登录设备。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.qnap.com/en/security-advisory/QSA-21-13

Reference

https://www.cybersecurity-help.cz/vdb/SB2021042329

Impacted products

Name
QNAP Systems HBS 3 Hybrid Backup Sync

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-28799"
    }
  },
  "description": "Qnap Systems QNAP HBS 3\u662f\u4e2d\u56fd\u5a01\u8054\u901a\uff08Qnap Systems\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u5e94\u7528\u7cfb\u7edf\u3002\u4e00\u79cd\u5168\u9762\u7684\u6570\u636e\u5907\u4efd\u548c\u707e\u96be\u6062\u590d\u89e3\u51b3\u65b9\u6848\u3002\n\nHBS 3 Hybrid Backup Sync\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u672a\u80fd\u5145\u5206\u7684\u6388\u6743\u68c0\u67e5\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u53ef\u4ee5\u7ed5\u8fc7\u6388\u6743\u68c0\u67e5\uff0c\u76f4\u63a5\u767b\u5f55\u8bbe\u5907\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.qnap.com/en/security-advisory/QSA-21-13",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-31949",
  "openTime": "2021-04-30",
  "patchDescription": "Qnap Systems QNAP HBS 3\u662f\u4e2d\u56fd\u5a01\u8054\u901a\uff08Qnap Systems\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u5e94\u7528\u7cfb\u7edf\u3002\u4e00\u79cd\u5168\u9762\u7684\u6570\u636e\u5907\u4efd\u548c\u707e\u96be\u6062\u590d\u89e3\u51b3\u65b9\u6848\u3002\r\n\r\nHBS 3 Hybrid Backup Sync\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u672a\u80fd\u5145\u5206\u7684\u6388\u6743\u68c0\u67e5\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u53ef\u4ee5\u7ed5\u8fc7\u6388\u6743\u68c0\u67e5\uff0c\u76f4\u63a5\u767b\u5f55\u8bbe\u5907\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Qnap Systems QNAP HBS 3\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "QNAP Systems HBS 3 Hybrid Backup Sync"
  },
  "referenceLink": "https://www.cybersecurity-help.cz/vdb/SB2021042329",
  "serverity": "\u9ad8",
  "submitTime": "2021-04-26",
  "title": "Qnap Systems QNAP HBS 3\u6388\u6743\u95ee\u9898\u6f0f\u6d1e"
}

FKIE_CVE-2021-28799

Vulnerability from fkie_nvd - Published: 2021-05-13 03:15 - Updated: 2026-06-17 03:46

CISA Shadowserver Previdian

Severity

10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security@qnapsecurity.com.tw	https://www.qnap.com/en/security-advisory/QSA-21-13	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.qnap.com/en/security-advisory/QSA-21-13	Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799	US Government Resource

Impacted products

Vendor	Product	Version
qnap	hybrid_backup_sync	*
qnap	qts	4.5.2
qnap	hybrid_backup_sync	*
qnap	qts	4.3.6
qnap	hybrid_backup_sync	*
qnap	qts	4.3.3
qnap	qts	4.3.4
qnap	hybrid_backup_sync	*
qnap	quts_hero	h4.5.1
qnap	hybrid_backup_sync	*
qnap	qutscloud	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "platforms": [
            "QTS 4.5.2"
          ],
          "product": "HBS 3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "v16.0.0415",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "QTS 4.3.6"
          ],
          "product": "HBS 3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "v3.0.210412",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "QTS 4.3.4"
          ],
          "product": "HBS 3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "v3.0.210411",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "QTS 4.3.3"
          ],
          "product": "HBS 3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "v3.0.210411",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "QuTS hero h4.5.1"
          ],
          "product": "HBS 3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "v16.0.0419",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "QuTScloud c4.5.1~c4.5.4"
          ],
          "product": "HBS 3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "v16.0.0419",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "HBS 2",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "status": "unaffected",
              "version": "all versions"
            }
          ]
        },
        {
          "product": "HBS 1.3",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "status": "unaffected",
              "version": "all versions"
            }
          ]
        }
      ],
      "source": "security@qnapsecurity.com.tw"
    }
  ],
  "cisaActionDue": "2022-04-21",
  "cisaExploitAdd": "2022-03-31",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "QNAP NAS Improper Authorization Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A18656F9-AFB4-44BC-AF08-E1A0A5D2EF49",
              "versionEndExcluding": "16.0.0415",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "1AC8BD83-EA71-4AF8-AAEC-E46EFCA99EA2",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5920EA4-EEA5-4F64-B06B-EED06E824864",
              "versionEndExcluding": "3.0.210412",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "FE9FAC96-AA2A-4CA5-A170-8C0E6BD47391",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "78491B95-5835-411B-B188-30E496BCB10A",
              "versionEndExcluding": "3.0.210411",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5994C07-17FE-4784-9FA4-9675BA8B4743",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0C7D2D4-769F-4297-89F4-75366FFA7618",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB2A5649-4BB9-46E9-8A1A-B6046125BD92",
              "versionEndExcluding": "16.0.0419",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:quts_hero:h4.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "548228B3-EB2C-42C1-895B-DA6DC5CA26EE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB2A5649-4BB9-46E9-8A1A-B6046125BD92",
              "versionEndExcluding": "16.0.0419",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FEDF704D-D5AD-45C2-AD7D-E53189C72E1A",
              "versionEndIncluding": "c4.5.4",
              "versionStartIncluding": "c4.5.1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 ."
    },
    {
      "lang": "es",
      "value": "Se ha reportado una vulnerabilidad de autorizaci\u00f3n inapropiada que afecta al QNAP NAS que ejecuta HBS versi\u00f3n 3 (Hybrid Backup Sync). Si es explotada, la vulnerabilidad permite a atacantes remotos iniciar sesi\u00f3n en un dispositivo. Este problema afecta a: QNAP Systems Inc. HBS 3 versiones anteriores a v16.0.0415 en QTS versi\u00f3n 4.5.2; versiones anteriores a v3.0.210412 en QTS versi\u00f3n 4.3.6; versiones anteriores a v3.0.210411 en QTS versi\u00f3n 4.3.4; versiones anteriores a v3.0.210411 en QTS versi\u00f3n 4.3.3; versiones anteriores a 16.0.0419 en QuTS hero versiones h4.5.1; anterior a versi\u00f3n v16.0.0419 en QuTScloud versiones c4.5.1~c4.5.4. Este problema no afecta a: QNAP Systems Inc. HBS versi\u00f3n 2. QNAP Systems Inc. HBS versi\u00f3n 1.3"
    }
  ],
  "id": "CVE-2021-28799",
  "lastModified": "2026-06-17T03:46:53.003",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0,
        "source": "security@qnapsecurity.com.tw",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-28799",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-02-04T14:53:29.275519Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2021-05-13T03:15:06.843",
  "references": [
    {
      "source": "security@qnapsecurity.com.tw",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799"
    }
  ],
  "sourceIdentifier": "security@qnapsecurity.com.tw",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ],
      "source": "security@qnapsecurity.com.tw",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-4V9X-J7PR-8WXQ

Vulnerability from github – Published: 2022-05-24 19:02 – Updated: 2025-10-22 00:32

Details

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-28799"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-13T03:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .",
  "id": "GHSA-4v9x-j7pr-8wxq",
  "modified": "2025-10-22T00:32:13Z",
  "published": "2022-05-24T19:02:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28799"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799"
    },
    {
      "type": "WEB",
      "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2021-28799

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

Aliases

CVE-2021-28799

Aliases

CVE-2021-28799

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-28799",
    "description": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .",
    "id": "GSD-2021-28799"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-28799"
      ],
      "details": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .",
      "id": "GSD-2021-28799",
      "modified": "2023-12-13T01:23:29.430684Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cisa.gov": {
      "cveID": "CVE-2021-28799",
      "dateAdded": "2022-03-31",
      "dueDate": "2022-04-21",
      "product": "Network Attached Storage (NAS)",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.",
      "vendorProject": "QNAP",
      "vulnerabilityName": "QNAP NAS Improper Authorization Vulnerability"
    },
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@qnap.com",
        "DATE_PUBLIC": "2021-04-22T00:54:00.000Z",
        "ID": "CVE-2021-28799",
        "STATE": "PUBLIC",
        "TITLE": "Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "HBS 3",
                    "version": {
                      "version_data": [
                        {
                          "platform": "QTS 4.5.2",
                          "version_affected": "\u003c",
                          "version_value": "v16.0.0415"
                        },
                        {
                          "platform": "QTS 4.3.6",
                          "version_affected": "\u003c",
                          "version_value": "v3.0.210412"
                        },
                        {
                          "platform": "QTS 4.3.4",
                          "version_affected": "\u003c",
                          "version_value": "v3.0.210411"
                        },
                        {
                          "platform": "QTS 4.3.3",
                          "version_affected": "\u003c",
                          "version_value": "v3.0.210411"
                        },
                        {
                          "platform": "QuTS hero h4.5.1",
                          "version_affected": "\u003c",
                          "version_value": "v16.0.0419"
                        },
                        {
                          "platform": "QuTScloud c4.5.1~c4.5.4",
                          "version_affected": "\u003c",
                          "version_value": "v16.0.0419"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "HBS 2",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "!",
                          "version_value": "all versions"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "HBS 1.3",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "!",
                          "version_value": "all versions"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "QNAP Systems Inc."
            }
          ]
        }
      },
      "credit": [
        {
          "lang": "eng",
          "value": "ZUSO ART"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 ."
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 10,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-285 Improper Authorization"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.qnap.com/en/security-advisory/QSA-21-13",
            "refsource": "MISC",
            "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
          }
        ]
      },
      "solution": [
        {
          "lang": "eng",
          "value": "QNAP have already fixed this vulnerability in the following versions of HBS 3:\nQTS 4.5.2: HBS 3 v16.0.0415 and later\nQTS 4.3.6: HBS 3 v3.0.210412 and later\nQTS 4.3.3 and 4.3.4: HBS 3 v3.0.210411 and later\nQuTS hero h4.5.1: HBS 3 v16.0.0419 and later\nQuTScloud c4.5.1~c4.5.4: HBS 3 v16.0.0419 and later"
        }
      ],
      "source": {
        "advisory": "QSA-21-13",
        "discovery": "EXTERNAL"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "16.0.0415",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:qnap:qts:4.5.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "3.0.210412",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "3.0.210411",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:qnap:qts:4.3.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:qnap:qts:4.3.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "16.0.0419",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:qnap:quts_hero:h4.5.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "16.0.0419",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "c4.5.4",
                    "versionStartIncluding": "c4.5.1",
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@qnap.com",
          "ID": "CVE-2021-28799"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 ."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qnap.com/en/security-advisory/QSA-21-13",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://www.qnap.com/en/security-advisory/QSA-21-13"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-11-14T19:26Z",
      "publishedDate": "2021-05-13T03:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2021-28799 (GCVE-0-2021-28799)

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

Shadowserver

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Characteristics

Timestamps

Scope

Evidence

Honeypot In The Wild Attempts Confidence: 70% Source: shadowserver

Details

References

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Confirmed Compromise Confidence: 70% Source: kevintel

Details

References

BDU:2021-05089 (CVE-2021-28799)

CERTFR-2021-AVI-307

Solution

CERTFR-2021-AVI-334

Solution

CNVD-2021-31949

FKIE_CVE-2021-28799

GHSA-4V9X-J7PR-8WXQ

GSD-2021-28799

Tags

Sightings

Nomenclature

Related by attack behaviour