CVE-2021-28799: QNAP HBS 3 improper authorization allows remote login

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, CISA KEV listing with known ransomware use, and a 0.7825 EPSS probability make this an actively exploited, remotely reachable authorization bypass.

What it is

QNAP Hybrid Backup Sync 3 (HBS 3) contains an improper authorization flaw that lets remote attackers log in to the NAS device. The issue affects multiple HBS 3 builds across QTS 4.5.2, QTS 4.3.6, QTS 4.3.4, QTS 4.3.3, QuTS hero h4.5.1 and QuTScloud c4.5.1~c4.5.4, while HBS 2 and HBS 1.3 are not affected. Because the flaw bypasses authorization on a network-exposed service, it is a serious risk to internet-facing QNAP devices.

Impact

An attacker gains the ability to log in to the affected device without valid credentials, which can lead to full control of the NAS and its data. CISA's KEV entry notes known ransomware campaign use tied to this vulnerability.

Attack surface

The CVSS vector is network-reachable with no privileges and no user interaction required, so the flaw is exploitable directly over the network against the HBS 3 service. No authentication is needed to reach the vulnerable code path.

Exploitation

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2022-03-31 with a due date of 2022-04-21 and flags known ransomware campaign use. EPSS gives a 30-day exploitation probability of 0.7825 (99.554th percentile), indicating very high likelihood of active exploitation.

What to do

• Update HBS 3 to the fixed build for your platform: v16.0.0415 or later on QTS 4.5.2, v3.0.210412 or later on QTS 4.3.6, v3.0.210411 or later on QTS 4.3.4 and 4.3.3, v16.0.0419 or later on QuTS hero h4.5.1 and QuTScloud c4.5.1~c4.5.4.
• If immediate patching is not possible, remove HBS 3 from internet exposure and restrict access to trusted management networks.
• Disable or block external access to the HBS 3 service and any related management ports until the update is applied.
• Review QNAP accounts and access logs for unexpected logins or new administrative sessions.
• Apply the vendor advisory QSA-21-13 guidance and verify the installed HBS 3 version after updating.

Detection

• Monitor QNAP authentication and access logs for successful logins from unexpected source IPs or at unusual times.
• Alert on HBS 3 service connections from external or untrusted networks.
• Hunt for new or modified administrator accounts and unexpected configuration changes on QNAP NAS devices.
• Correlate NAS log events with known ransomware indicators and outbound connections from the device.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.