CVE-2021-28799

CVE-2021-28799 is a critical-severity (CVSS 10.0) vulnerability in QNAP Network Attached Storage (NAS). CISA added it to the Known Exploited Vulnerabilities catalog on March 31, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 21, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. QNAP has 11 vulnerabilities in the KEV catalog, 9 of them linked to ransomware.

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• https://www.qnap.com/en/security-advisory/QSA-21-13
• https://www.qnap.com/en/security-advisory/QSA-21-13
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799