CVE-2021-28799

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 78.25%
EPSS Percentile: 99.58%
CISA KEV: YES — Known Exploited Vulnerability

Description

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 13-May-2021 10:15
Last Modified: 17-Jun-2026 10:46
EPSS Date: 2026-11-02
CWE: CWE-285

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2022-03-31
Remediation Due: 2022-04-21
Known Ransomware Campaign Use: Known
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2021-28799

CNA Products / Version Status

QNAP Systems Inc. · HBS 1.3 Source: CNA · [email protected]
Default status: unknown

all versions — unaffected
QNAP Systems Inc. · HBS 2 Source: CNA · [email protected]
Default status: unknown

all versions — unaffected
QNAP Systems Inc. · HBS 3 Source: CNA · [email protected]
Default status: unknown

unspecified ≤ version < v3.0.210411 — affected (custom)

Platforms: QTS 4.3.3
QNAP Systems Inc. · HBS 3 Source: CNA · [email protected]
Default status: unknown

unspecified ≤ version < v3.0.210411 — affected (custom)

Platforms: QTS 4.3.4
QNAP Systems Inc. · HBS 3 Source: CNA · [email protected]
Default status: unknown

unspecified ≤ version < v3.0.210412 — affected (custom)

Platforms: QTS 4.3.6
QNAP Systems Inc. · HBS 3 Source: CNA · [email protected]
Default status: unknown

unspecified ≤ version < v16.0.0415 — affected (custom)

Platforms: QTS 4.5.2
QNAP Systems Inc. · HBS 3 Source: CNA · [email protected]
Default status: unknown

unspecified ≤ version < v16.0.0419 — affected (custom)

Platforms: QuTS hero h4.5.1
QNAP Systems Inc. · HBS 3 Source: CNA · [email protected]
Default status: unknown

unspecified ≤ version < v16.0.0419 — affected (custom)

Platforms: QuTScloud c4.5.1~c4.5.4

Affected Products / Versions

qnap / hybrid_backup_sync Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 16.0.0415
cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*
qnap / hybrid_backup_sync Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 3.0.210412
cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*
qnap / hybrid_backup_sync Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 3.0.210411
cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*
qnap / hybrid_backup_sync Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 16.0.0419
cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*

References

Last enrichment sync: 03-Nov-2026 16:01
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

eCh0raix variant targeting NAS devices from both QNAP and Synology by leveraging vulnerabilities like CVE-2021-28799 or brute-force their way in by making use of commonly used administrative credentials. Synology Says Ransomware Actors Exploit Patched DSM Flaw to Target NAS Devices

Malware (3)

MITRE ATT&CK (2)

Vendors (2)

Products (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.