Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2021-28799

CVE-2021-28799CRITICAL

QNAP Systems Inc. HBS 3 — Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  H   10.0   .7825   99.6   YES

AFFECTED
  Product  Versions       Fixed
  HBS 3    unspecified –  —
  HBS 3    unspecified –  —
  HBS 3    unspecified –  —
  HBS 3    unspecified –  —
  HBS 3    unspecified –  —
  HBS 3    unspecified –  —
  HBS 2    unspecified    all versions
  HBS 1.3  unspecified    all versions

TIMELINE
  Mar 18  Reserved by qnap
  May 13  Published (CNA: qnap)
  Mar 31  Added to CISA KEV, remediation due 2022-04-21

CWE-285 · CNA: qnap · CVSS v3.1 · 2 references · KEV due April 21, 2022

Description

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
March 18, 2021	Reserved	Reserved by qnap
May 13, 2021	Published	Published (CNA: qnap)
March 31, 2022	KEV ADDED	Added to CISA KEV, remediation due 2022-04-21

Affected

Affected products and packages — 8 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
QNAP Systems Inc.	HBS 3	—	unspecified	—
QNAP Systems Inc.	HBS 3	—	unspecified	—
QNAP Systems Inc.	HBS 3	—	unspecified	—
QNAP Systems Inc.	HBS 3	—	unspecified	—
QNAP Systems Inc.	HBS 3	—	unspecified	—
QNAP Systems Inc.	HBS 3	—	unspecified	—
QNAP Systems Inc.	HBS 2	—	—	all versions
QNAP Systems Inc.	HBS 1.3	—	—	all versions

Weaknesses

CWE-285

References (2)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799 [government-resource]
https://www.qnap.com/en/security-advisory/QSA-21-13 [x_refsource_MISC]

Authoritative record: CVE-2021-28799 at cve.org

Vendors: qnap systems

Weaknesses: CWE-285

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-28799 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.