CVE-2021-28799

Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)

State: Published
Severity: 10.0 Critical
Published: May 13, 2021
Updated: Oct 21, 2025
Reserved: Mar 18, 2021

Description

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	qnap

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
HBS 3QNAP Systems Inc.	before v16.0.0415Affected
HBS 3QNAP Systems Inc.	before v3.0.210412Affected
HBS 3QNAP Systems Inc.	before v3.0.210411Affected
HBS 3QNAP Systems Inc.	before v3.0.210411Affected
HBS 3QNAP Systems Inc.	before v16.0.0419Affected
HBS 3QNAP Systems Inc.	before v16.0.0419Affected
HBS 2QNAP Systems Inc.	all versionsNot affected
HBS 1.3QNAP Systems Inc.	all versionsNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.