Live › vulnerability › CVE-2021-28799
Go to dashboardQNAP NAS devices running HBS 3 have an improper authorization flaw that lets remote attackers log in to the device. It is listed in CISA's known-exploited catalog and tagged for ransomware use.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| QNAP Network Attached Storage (NAS) | vendor | – | – |
Check whether a QNAP NAS runs the HBS 3 (Hybrid Backup Sync) app, which the sources name as affected; the sources do not give a command or version range.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .
This page as .md · .json · in your agent: get_signal("CVE-2021-28799")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.