Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2021-28799: QNAP NAS allows remote attackers to log in
CVE-2021-28799 · published 5 years ago · actively exploited
Summary
QNAP network‑attached storage devices running Hybrid Backup Sync version 3 do not properly check who is accessing them. This weakness could let someone from the internet sign in without permission and view or change your data. Apply the latest QNAP firmware or update the Hybrid Backup Sync app as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| qnap | network attached storage (nas) | All versions |
| qnap | hybrid_backup_sync |
< 16.0.0415 < 3.0.210412 < 3.0.210411 < 16.0.0419 cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:* |
Original advisory text
QNAP NAS Improper Authorization Vulnerability
QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.
References
- https://www.qnap.com/en/security-advisory/QSA-21-13 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-... US Government Resource
Internet-facing
3 days
and check for signs of compromise
Internal
3 days
and check for signs of compromise
- Known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
78%
chance of attack within 30 days
Type
CWE-285Improper Authorization
Timeline
Published13 May 2021
Updated30 Sep 2026
First seen6 Mar 2026
Track software like this
Free during beta