Read the docs
TI-2021-09791 Aliases CVE-2021-28799GHSA-4v9x-j7pr-8wxq

Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)

Priority CRITICAL 100Exploited in the wildCWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

Why it matters now

Exploitation Active In CISA KEV since 2022-03-31CISA due date 2022-04-21Known ransomware use
EPSS 0.7825 99th percentileScored 2026-11-07
Fix Fixed HBS 3 (QNAP Systems Inc.): v16.0.0415, v3.0.210412, v3.0.210411 +1HBS 2 (QNAP Systems Inc.): all versions+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPHBS 3before v16.0.0415v16.0.0415Patch availableCNA
QNAPHBS 3before v3.0.210412v3.0.210412Patch availableCNA
QNAPHBS 3before v3.0.210411v3.0.210411Patch availableCNA
QNAPHBS 3before v3.0.210411v3.0.210411Patch availableCNA
QNAPHBS 3before v16.0.0419v16.0.0419Patch availableCNA
QNAPHBS 3before v16.0.0419v16.0.0419Patch availableCNA
QNAPHBS 2—all versionsPatch availableCNA
QNAPHBS 1.3—all versionsPatch availableCNA
  • HBS 3 VendorQNAP Affected before v16.0.0415 Fixed in v16.0.0415 Patch available CNA
  • HBS 3 VendorQNAP Affected before v3.0.210412 Fixed in v3.0.210412 Patch available CNA
  • HBS 3 VendorQNAP Affected before v3.0.210411 Fixed in v3.0.210411 Patch available CNA
  • HBS 3 VendorQNAP Affected before v3.0.210411 Fixed in v3.0.210411 Patch available CNA
  • HBS 3 VendorQNAP Affected before v16.0.0419 Fixed in v16.0.0419 Patch available CNA
  • HBS 3 VendorQNAP Affected before v16.0.0419 Fixed in v16.0.0419 Patch available CNA
  • HBS 2 VendorQNAP Affected — Fixed in all versions Patch available CNA
  • HBS 1.3 VendorQNAP Affected — Fixed in all versions Patch available CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*before 16.0.0415VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.2:*:*:*:*:*:*:*4.5.2Running onQNAP
cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*before 3.0.210412VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*4.3.6Running onQNAP
cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*before 3.0.210411VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*4.3.3Running onQNAP
cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:*4.3.4Running onQNAP
cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*before 16.0.0419VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.1:*:*:*:*:*:*:*h4.5.1Running onQNAP
cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*c4.5.1 – c4.5.4Running onQNAP
  • cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:* Versions before 16.0.0415 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.2:*:*:*:*:*:*:* Versions 4.5.2 Running on ·QNAP
  • cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:* Versions before 3.0.210412 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:* Versions 4.3.6 Running on ·QNAP
  • cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:* Versions before 3.0.210411 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:* Versions 4.3.3 Running on ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:* Versions 4.3.4 Running on ·QNAP
  • cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:* Versions before 16.0.0419 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.1:*:*:*:*:*:*:* Versions h4.5.1 Running on ·QNAP
  • cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:* Versions c4.5.1 – c4.5.4 Running on ·QNAP

Remediation

  • Fix · CNA HBS 3 (QNAP Systems Inc.) Fixed in v16.0.0415
  • Fix · CNA HBS 3 (QNAP Systems Inc.) Fixed in v3.0.210412
  • Fix · CNA HBS 3 (QNAP Systems Inc.) Fixed in v3.0.210411
  • Fix · CNA HBS 3 (QNAP Systems Inc.) Fixed in v3.0.210411
  • Fix · CNA HBS 3 (QNAP Systems Inc.) Fixed in v16.0.0419
  • Fix · CNA HBS 3 (QNAP Systems Inc.) Fixed in v16.0.0419
  • Fix · CNA HBS 2 (QNAP Systems Inc.) Fixed in all versions
  • Fix · CNA HBS 1.3 (QNAP Systems Inc.) Fixed in all versions

Timeline

  1. 2022-03-31 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2021-28799
  3. 2026-10-03 Alias added: GHSA-4v9x-j7pr-8wxq

References

Advisory 1

  • TI-2021-09800 Missing Authentication for Critical Function in RTRR Server in HBS3 CVSS 3.1CRITICAL 9.8
  • TI-2024-33823 Command injection in QNAP HBS 3 Hybrid Backup Sync CVSS 4.0CRITICAL 9.5
  • TI-2025-38995 An external control of file name or path vulnerability has been reported to affect HBS 3… CVSS 4.0HIGH 7.0
  • TI-2025-38994 Information disclosure through error messages in QNAP HBS 3 Hybrid Backup Sync CVSS 4.0HIGH 7.0
  • TI-2024-35893 Buffer overflow in QNAP HBS 3 Hybrid Backup Sync CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences