{"id":"CVE-2021-28799","published":"2021-05-13T03:15:06Z","modified":"2026-06-17T03:46:53Z","title":"QNAP NAS Improper Authorization Vulnerability","vendor":"QNAP","product":"Network Attached Storage (NAS)","tier":"core","eol":null,"description":{"text":"An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .","provenance":"source","from":"NVD"},"summary":{"text":"An improper authorization flaw in the Hybrid Backup Sync 3 (HBS 3) component of QNAP Network Attached Storage (NAS) devices allows remote attackers to log in to affected devices. An attacker needs only network access to the device, with no prior authentication or user interaction required, and the affected versions are those listed as prior to the fixed releases for QTS, QuTS hero and QuTScloud.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:02:04Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.7825,"percentile":0.99578,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-03-31","dueDate":"2022-04-21","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-28799","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-04-29","exploitedFirstSeen":"2021-04-29","ransomware":true,"evidence":[{"url":"https://www.qnap.com/en-us/security-advisory/QSA-21-15","date":"2021-04-29"},{"url":"https://www.qnap.com/en/security-advisory/qsa-21-12","date":"2021-05-21"},{"url":"https://www.secureblink.com/threat-research/qlocker-ransomware","date":"2021-07-28"},{"url":"https://threatpost.com/ech0raix-ransomware-variant-qnap-synology-nas-devices/168516/","date":"2021-08-10"},{"url":"https://unit42.paloaltonetworks.com/ech0raix-ransomware-soho/","date":"2021-08-10"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/ransomware_index-update-q221-csw.pdf","date":"2021-08-16"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/ransomware-_-2022-spotlight-report_compressed.pdf","date":"2022-01-26"},{"url":"https://unit42.paloaltonetworks.com/sockdetour/","date":"2022-02-24"},{"url":"https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/2022-unit42-ransomware-threat-report-final.pdf","date":"2022-03-24"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-31"}],"evidenceTotal":211,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-285","name":"Improper Authorization"}],"references":[{"url":"https://www.qnap.com/en/security-advisory/QSA-21-13","tags":["Vendor Advisory"]},{"url":"https://www.qnap.com/en/security-advisory/QSA-21-13","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: remote unauthenticated exploitation of exposed service","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to log in to a device","start":146,"end":191}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: gains valid login access to device","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote attackers to log in to a device","start":146,"end":191}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-15455","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-15455","exploited":true,"exploitedSince":"2022-03-31","provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2021-28799","name":"QNAP HBS 3 - Broken Access Control","severity":"critical","path":"http/cves/2021/CVE-2021-28799.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28799.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2021-04-29","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.qnap.com/en-us/security-advisory/QSA-21-15","provenance":"source"},{"date":"2021-05-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28799","provenance":"source"},{"date":"2022-03-31","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-31","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-15455","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":322},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2011 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9958"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}