CASCACascade Atlas

Evidence dossier

CVE-2021-28799

Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)

76.4–97.7Priority evidence range
As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9

Normalized restatement

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

State
PUBLISHED
Published
May 13, 2021
Updated
Oct 21, 2025
Evidence coverage
72%
CISA KEVCatalog member

Apply updates per vendor instructions.

FIRST EPSS78.25%

2026-07-18 · v2026.06.15 · percentile 99.5%

Source stateConflict visible

Distinct CVSS assessments remain side by side; none are averaged.

Source comparison

Who said what

CISA-ADPindependent enrichment
container

CISA ADP Vulnrichment

CVEderivative copy
container

CVE Program Container

qnaporiginal assertion
container

Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)

CISA KEVoriginal assertion
observed_exploitation

QNAP NAS Improper Authorization Vulnerability

FIRST EPSSoriginal assertion
model_probability

Probability 0.782500000000; percentile 0.995300000000

Applicability

Cited product scope

Trace impact →
QNAP Systems Inc.HBS 1.3
[{"status": "unaffected", "version": "all versions"}]unknown
QNAP Systems Inc.HBS 2
[{"status": "unaffected", "version": "all versions"}]unknown
QNAP Systems Inc.HBS 3
[{"status": "affected", "version": "unspecified", "lessThan": "v3.0.210411", "versionType": "custom"}]unknown
QNAP Systems Inc.HBS 3
[{"status": "affected", "version": "unspecified", "lessThan": "v3.0.210411", "versionType": "custom"}]unknown
QNAP Systems Inc.HBS 3
[{"status": "affected", "version": "unspecified", "lessThan": "v16.0.0415", "versionType": "custom"}]unknown
QNAP Systems Inc.HBS 3
[{"status": "affected", "version": "unspecified", "lessThan": "v16.0.0419", "versionType": "custom"}]unknown
QNAP Systems Inc.HBS 3
[{"status": "affected", "version": "unspecified", "lessThan": "v16.0.0419", "versionType": "custom"}]unknown
QNAP Systems Inc.HBS 3
[{"status": "affected", "version": "unspecified", "lessThan": "v3.0.210412", "versionType": "custom"}]unknown
Unknown vendorUnknown product
cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*; end excluding 16.0.0415supported
Unknown vendorUnknown product
cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*; end excluding 3.0.210412supported
Unknown vendorUnknown product
cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*; end excluding 3.0.210411supported
Unknown vendorUnknown product
cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*; end excluding 16.0.0419supported
Unknown vendorUnknown product
cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*; end excluding 16.0.0419supported
Unknown vendorUnknown product
cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*constrained
Unknown vendorUnknown product
cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:*constrained
Unknown vendorUnknown product
cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*constrained
Unknown vendorUnknown product
cpe:2.3:o:qnap:qts:4.5.2:*:*:*:*:*:*:*constrained
Unknown vendorUnknown product
cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*; start including c4.5.1; end including c4.5.4constrained
Unknown vendorUnknown product
cpe:2.3:o:qnap:quts_hero:h4.5.1:*:*:*:*:*:*:*constrained

Assessments

CVSS by origin

9.8
nvd@nist.govCVSS 3.1 · role PrimaryCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5
nvd@nist.govCVSS 2.0 · role PrimaryAV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
security@qnapsecurity.com.twCVSS 3.1 · role SecondaryCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10.0
qnapCVSS 3.1 · role unknownCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Limitations and unknowns

  • KEV membership is authoritative for the catalog, not proof of exposure in any environment.
  • EPSS is a dated model probability and not an individual-environment prediction.
  • Affected or fixed status applies only to the exact cited product and version scope; unresolved scope remains unknown.
  • NVD-carried upstream facts remain derivative and are not independent corroboration.
  • Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
  • NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
  • Factor D is unknown in Public Core because no accepted canonical mapping-obligation ledger is present.
  • Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.