CVE-2021-28799 : An improper authorization vulnerability has been reported to affect QNAP NAS run

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

Published 2021-05-13 03:15:07

Updated 2023-11-14 19:26:49

Source QNAP Systems, Inc.

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2021-28799

Qnap » Hybrid Backup Sync
Versions before (<) 3.0.210411
cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*
Matching versions
When used together with: Qnap » QTS » Version: 4.3.3
When used together with: Qnap » QTS » Version: 4.3.4
Qnap » Hybrid Backup Sync
Versions before (<) 16.0.0415
cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*
Matching versions
When used together with: Qnap » QTS » Version: 4.5.2
Qnap » Hybrid Backup Sync
Versions before (<) 16.0.0419
cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*
Matching versions
When used together with: Qnap » Quts Hero » Version: H4.5.1
Qnap » Hybrid Backup Sync
Versions before (<) 3.0.210412
cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*
Matching versions
When used together with: Qnap » QTS » Version: 4.3.6

CVE-2021-28799 is in the CISA Known Exploited Vulnerabilities Catalog

This issue is known to have been leveraged as part of a ransomware campaign.

CISA vulnerability name:

QNAP NAS Improper Authorization Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2021-28799

Added on 2022-03-31 Action due date 2022-04-21

Exploit prediction scoring system (EPSS) score for CVE-2021-28799

EPSS FAQ

87.99%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-28799

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
10.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	3.9	6.0	QNAP Systems, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2021-28799

CWE-285 Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Assigned by: security@qnapsecurity.com.tw (Secondary)

References for CVE-2021-28799

https://www.qnap.com/en/security-advisory/QSA-21-13

Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync) - Security Advisory | QNAP
Vendor Advisory