CVE-2021-28799: QNAP NAS Improper Authorization Vulnerability
CVE-2021-28799 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2022-03-31
An improper authorization vulnerability in QNAP NAS devices running HBS 3 (Hybrid Backup Sync) allows remote attackers to log in to the device without proper credentials. This vulnerability has been observed being exploited in the wild.
Yes. CVE-2021-28799 is known to be exploited in the wild, first recorded on 31 March 2022. Treat it as urgent.
How severe is CVE-2021-28799?
Critical severity, with a CVSS score of 9.8, published 31 March 2022.
Which products and versions are affected?
QNAP Systems Inc. HBS 3 (Hybrid Backup Sync) prior to v16.0.0415 on QTS 4.5.2; prior to v3.0.210412 on QTS 4.3.6; prior to v3.0.210411 on QTS 4.3.4; prior to v3.0.210411 on QTS 4.3.3; prior to v16.0.0419 on QuTS hero h4.5.1; prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4.
Is there a fix for CVE-2021-28799?
A patch was published on 2021-04-16: Vendor released patches for various OS versions (based on version strings like 210412) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-28799 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2021-28799?
Check whether you run QNAP Network Attached Storage (NAS). Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Affected products
QNAP Systems Inc. HBS 3 (Hybrid Backup Sync) prior to v16.0.0415 on QTS 4.5.2; prior to v3.0.210412 on QTS 4.3.6; prior to v3.0.210411 on QTS 4.3.4; prior to v3.0.210411 on QTS 4.3.3; prior to v16.0.0419 on QuTS hero h4.5.1; prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4
Timeline
2021-04-16: patched: Vendor released patches for various OS versions (based on version strings like 210412)
2022-03-31: kev added: Added to CISA Known Exploited Vulnerabilities Catalog