CISA KEV · Known exploitedCritical

CVE-2021-28799

QNAP Network Attached Storage (NAS)

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

CVSS: 9.8
EPSS: 78.3%
CISA KEV: Listed
Published: 2021.05.13

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability78.3%

Technical severityCVSS 9.8

Vulnerability overview

Affected product and versions

Product: QNAP Network Attached Storage (NAS)
Affected versions: unspecified, < 16.0.0415, < 3.0.210412, < 3.0.210411, < 16.0.0419
Fixed versions: 16.0.0415, 3.0.210412, 3.0.210411, 16.0.0419

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply updates per vendor instructions.

Due date: 2022.04.21

1
Identify
Confirm that QNAP Network Attached Storage (NAS) and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-285
KEV added: 2022.03.31
Ransomware use: 확인됨