Is CVE-2021-28799 actively exploited?

CVE-2021-28799 has no public evidence of in-the-wild exploitation as of 2025-11-03.

What is the CVSS score for CVE-2021-28799?

CVE-2021-28799 has a CVSS score of 10 (CRITICAL severity). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

How do I patch CVE-2021-28799?

Patch guidance is available from qnap security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2021-28799.

Fix CVE-2021-28799 - CRITICAL qnap hybrid backup sync

Q: Which products are affected by CVE-2021-28799?

5 products: qnap hybrid backup sync, qnap hybrid backup sync, qnap hybrid backup sync, qnap hybrid backup sync, qnap hybrid backup sync.

Description

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector: network
Complexity: low
Privileges: none
User Action: none
Scope: changed
Confidentiality: high
Integrity: high
Availability: high
Weaknesses: CWE-285NVD-CWE-Other

Metadata

Primary Vendor: QNAP
Published: 5/13/2021
Last Modified: 11/3/2025
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

qnap : hybrid_backup_syncqnap : hybrid_backup_syncqnap : hybrid_backup_syncqnap : hybrid_backup_syncqnap : hybrid_backup_sync

Remediation Guidance

Executive Summary

View on NIST NVD