Critical severity · published Jul 8, 2021
CVE-2021-28809
An improper access control vulnerability has been reported to affect certain legacy versions of HBS 3
9.8
CVSS
16.1%
EPSS
No
On KEV
Description
An improper access control vulnerability has been reported to affect certain legacy versions of HBS 3. If exploited, this vulnerability allows attackers to compromise the security of the operating system.QNAP have already fixed this vulnerability in the following versions of HBS 3: QTS 4.3.6: HBS 3 v3.0.210507 and later QTS 4.3.4: HBS 3 v3.0.210506 and later QTS 4.3.3: HBS 3 v3.0.210506 and later
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)16.1% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HB
Hybrid Backup Sync · Qnap
before 3.0.210507; before 3.0.210506; before 3.0.210506 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-28809
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-28809
Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-21-19
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-783/
More from Hybrid Backup Sync
9.8
CVE-2021-28799
Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)
9.8
CVE-2024-50388
An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync
9.1
CVE-2024-53695
A buffer overflow vulnerability has been reported to affect HBS 3 Hybrid Backup Sync
7.8
CVE-2025-62842
An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync
3.3
CVE-2025-62840
A generation of error message containing sensitive information vulnerability has been reported to affect HBS 3 Hybrid Backup Sync