QNAP HBS 3 (Hybrid Backup Sync) Improper Authorization Vulnerability (CVE-2021-28799) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTQNAP HBS 3 (Hybrid Backup Sync) running on QTS, QuTS hero, and QuTScloud operating systems
Unauthenticated remote attackers can exploit improper authorization to log in to the device with administrative privileges, potentially leading to full system compromise
Immediately update HBS 3 to the patched versions and restrict external internet access to the NAS management interface
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Update HBS 3 to the latest version via the QNAP App Center. To perform a manual update via the CLI, use the following commands:
# Download and manually install the patched HBS 3 package via QNAP CLI
# 1. Download the appropriate package (example for x86_64 architecture)
wget -O /share/Public/HybridBackup.qpkg 'https://download.qnap.com/QPKG/HybridBackup_16.0.0415_x86_64.qpkg'
# 2. Stop the running service, install the package, and restart the service
/sbin/qpkg_cli --stop HybridBackup
/sbin/qpkg_cli --install /share/Public/HybridBackup.qpkg
/sbin/qpkg_cli --start HybridBackup2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, block all external access to the NAS management ports and restrict access to trusted internal networks only.
# Restrict access to QTS management ports (default 8080, 443) using iptables
# Allow trusted local subnet (e.g., 192.168.1.0/24) and drop all other traffic
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 8080 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP3. Log Audit & IoC Verification Commands
Run the following commands on the QNAP terminal to verify the installed HBS 3 version and inspect logs for unauthorized access attempts.
# 1. Check the currently installed HBS 3 version
getcfg HybridBackup Version -f /etc/config/qpkg.conf
# 2. Search system logs for suspicious HBS 3 activity or unauthorized logins
logtool -v | grep -E 'HybridBackup|HBS|login|unauthorized'
# 3. Inspect active network connections on HBS 3 related ports
netstat -antp | grep -E '8080|443' | grep ESTABLISHEDStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-28799) is an improper authorization flaw (CWE-285) identified in QNAP's HBS 3 (Hybrid Backup Sync) application. The root cause lies in the lack of robust session validation and access control checks within specific API endpoints used by the backup service. This allows remote, unauthenticated attackers to bypass authentication mechanisms, potentially leveraging hardcoded credentials or residual development accounts to gain unauthorized access.
2. Exploitation Mechanics & Attack Scenario
An attacker scans the internet for exposed QNAP NAS devices running vulnerable HBS 3 services. By sending crafted HTTP requests to the HBS 3 API endpoints, the attacker triggers an authentication bypass. This action generates a valid administrative session or activates a hidden account, allowing the attacker to log in to the device's web administration interface or SSH service without knowing the actual administrator password. This vulnerability has been actively exploited in the wild by ransomware groups (such as Qlocker) to encrypt user data.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk to enterprise infrastructure. Successful exploitation leads to complete compromise of the NAS device, enabling attackers to exfiltrate, delete, or encrypt critical backup data. This can result in severe business disruption, loss of intellectual property, and significant financial damage due to ransomware demands.
Official Vendor Advisories & References
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .
Frequently Asked SecOps Questions (CVE-2021-28799)
FAQQ1. How critical is CVE-2021-28799 and is it actively exploited in the wild?
CVE-2021-28799 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 78.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-28799?
Primary impacted vendors include qnap across hbs 3, qts, quts hero, qutscloud. Scope summary: QNAP HBS 3 versions prior to v16.0.0415 (QTS 4.5.2), v3.0.210412 (QTS 4.3.6), v3.0.210411 (QTS 4.3.4/4.3.3), v16.0.0419 (QuTS hero h4.5.1), and v16.0.0419 (QuTScloud c4.5.1~c4.5.4). HBS 2 and HBS 1.3 are not affected.
Q3. What temporary mitigations or workarounds exist for CVE-2021-28799 before patching?
[Mitigation] Immediately update HBS 3 to the patched versions and restrict external internet access to the NAS management interface Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-28799
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (qnap)
View Category →Arista VeloCloud Orchestrator (VCO) Remote Code Execution and Privilege Escalation (CVE-2026-93952)
[Affected Scope] Arista VeloCloud Orchestrator (VCO) On-premise deployments.
Cisco Identity Services Engine (ISE) Critical Authentication Bypass Vulnerability (CVE-2026-76460)
[Affected Scope] Cisco Identity Services Engine (ISE) web-based management interface and API endpoints.
SonicWall SMA1000 Work Place Pre-Authentication Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-83548)
[Affected Scope] SonicWall SMA1000 Series Appliance Work Place interface
Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.