CRITICAL🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2021-28799

CVSS 10.0v3.1pub. 2021-05-13upd. 2025-11-03

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Qnap Hybrid Backup Sync

    APP
    Qnap
    < 3.0.210411< 16.0.0419< 3.0.210412< 16.0.0415

  • Qnap Qts

    OS
    Qnap
    4.3.34.3.44.3.64.5.2

  • Qnap Qutscloud

    OS
    Qnap
    c4.5.1 – c4.5.4

  • Qnap Quts Hero

    OS
    Qnap
    h4.5.1

CISA KEV — detailsi

Vendori
QNAP
Producti
Network Attached Storage (NAS)
Added to KEVi
March 31, 2022
Remediation deadline (US Federal)i
April 21, 2022(overdue)
Ransomwarei
Active ransomware campaigns exploit this vulnerability
Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
☠️WYKORZYSTYWANE W RANSOMWARE⏰CISA DEADLINE: 21 kwietnia 2022
CWE
References

Related vulnerabilities

CVE-2022-27593CRITICAL10.0⚠ KEVten sam produkt

An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Ph...

CVE-2020-2509CRITICAL9.8⚠ KEVten sam produkt

A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerabil...

CVE-2018-19949CRITICAL9.8⚠ KEVten sam produkt

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNA...

CVE-2019-7194CRITICAL9.8⚠ KEVten sam produkt

This external control of file name or path vulnerability allows remote attackers to access or modify system fi...

CVE-2019-7192CRITICAL9.8⚠ KEVten sam produkt

This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. ...