# CVE-2021-28799: QNAP NAS Improper Authorization Vulnerability

Source: https://junglewise.ai/threats/cve-2021-28799-qnap-nas-improper-authorization-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-03-31. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2021-28799 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2022-03-31

An improper authorization vulnerability in QNAP NAS devices running HBS 3 (Hybrid Backup Sync) allows remote attackers to log in to the device without proper credentials. This vulnerability has been observed being exploited in the wild.

Technologies: [QNAP Network Attached Storage (NAS)](https://junglewise.ai/threats/technologies/network-attached-storage-nas). Vendors: [QNAP](https://junglewise.ai/threats/vendors/qnap).

## Quick answers

**Is CVE-2021-28799 exploited in the wild?** Yes. CVE-2021-28799 is known to be exploited in the wild, first recorded on 31 March 2022. Treat it as urgent.

**How severe is CVE-2021-28799?** Critical severity, with a CVSS score of 9.8, published 31 March 2022.

**Which products and versions are affected?** QNAP Systems Inc. HBS 3 (Hybrid Backup Sync) prior to v16.0.0415 on QTS 4.5.2; prior to v3.0.210412 on QTS 4.3.6; prior to v3.0.210411 on QTS 4.3.4; prior to v3.0.210411 on QTS 4.3.3; prior to v16.0.0419 on QuTS hero h4.5.1; prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4.

**Is there a fix for CVE-2021-28799?** A patch was published on 2021-04-16: Vendor released patches for various OS versions (based on version strings like 210412) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-28799 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2021-28799?** Check whether you run QNAP Network Attached Storage (NAS). Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- QNAP Systems Inc. HBS 3 (Hybrid Backup Sync) prior to v16.0.0415 on QTS 4.5.2; prior to v3.0.210412 on QTS 4.3.6; prior to v3.0.210411 on QTS 4.3.4; prior to v3.0.210411 on QTS 4.3.3; prior to v16.0.0419 on QuTS hero h4.5.1; prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4

## Timeline

- 2021-04-16: patched: Vendor released patches for various OS versions (based on version strings like 210412)
- 2022-03-31: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2022-03-31: disclosed: NVD publication date

## Related threats

- [QNAP NAS File Station Command Injection Vulnerability](https://junglewise.ai/threats/cve-2018-19949-qnap-nas-file-station-command-injection-vulnerability)
- [QNAP NAS File Station Cross-Site Scripting Vulnerability](https://junglewise.ai/threats/cve-2018-19953-qnap-nas-file-station-cross-site-scripting-vulnerability)
- [QNAP NAS File Station Cross-Site Scripting Vulnerability](https://junglewise.ai/threats/cve-2018-19943-qnap-nas-file-station-cross-site-scripting-vulnerability)
- [QNAP Network-Attached Storage (NAS) Command Injection Vulnerability](https://junglewise.ai/threats/cve-2020-2509-qnap-network-attached-storage-nas-command-injection-vulnerability)