CVE-2021-28799

What it actually does

This is a network-reachable improper authorization flaw in QNAP HBS 3 Hybrid Backup Sync that can allow an unauthenticated remote attacker to log in to an affected NAS device. Successful exploitation bypasses expected access controls and can give the attacker interactive access to NAS functionality and stored data, creating a high-impact confidentiality, integrity, and availability risk. The issue affects HBS 3 on multiple QTS, QuTS hero, and QuTScloud releases; HBS 2 and HBS 1.3 are not affected.

Why it matters to the business

Compromise of a NAS or backup appliance can expose sensitive files, backups, and operational data, and can also give attackers the ability to delete, alter, or encrypt data needed for recovery. This vulnerability is listed in CISA KEV, has been used in ransomware campaigns, has a high EPSS score, and exploitation has been observed in the wild, so exposed systems should be treated as urgent remediation targets even though the issue is several years old.

How an attack unfolds

An attacker scans the internet or internal networks for QNAP NAS devices exposing the management interface or HBS 3 services. After identifying a vulnerable HBS 3 version, the attacker sends crafted requests that bypass authorization checks and obtain login access without valid credentials. With access to the NAS, the attacker can enumerate users, shares, snapshots, and backup jobs; download or stage data; modify backup configurations; create persistence where permitted; and deploy destructive payloads such as ransomware. In ransomware activity against NAS appliances, attackers commonly use the access to encrypt user files or backup repositories and then leave ransom instructions, directly impacting recovery capability.

How to fix it

Upgrade HBS 3 to a fixed version or later for the platform in use: QTS 4.5.2: HBS 3 v16.0.0415 or later; QTS 4.3.6: HBS 3 v3.0.210412 or later; QTS 4.3.4: HBS 3 v3.0.210411 or later; QTS 4.3.3: HBS 3 v3.0.210411 or later; QuTS hero h4.5.1: HBS 3 v16.0.0419 or later; QuTScloud c4.5.1 through c4.5.4: HBS 3 v16.0.0419 or later. If immediate upgrade is not possible, remove internet exposure for NAS management and HBS services, restrict access to trusted VPN or administrative networks, disable unused HBS functionality, enforce MFA where available, rotate NAS credentials, and verify that backups are offline or immutable. Because this vulnerability is in KEV and associated with ransomware, remediation should be prioritized ahead of routine patch cycles.

How to confirm the fix worked

Confirm the installed HBS 3 version from QNAP App Center or command-line package inventory and verify it meets or exceeds the fixed version for the relevant QTS, QuTS hero, or QuTScloud release. Validate that HBS 3 management endpoints are not reachable from the public internet unless explicitly required and protected by compensating controls. Run authenticated vulnerability scans or configuration audits against QNAP appliances to confirm the vulnerable package is no longer present. After patching, test normal HBS backup and sync jobs, review administrative account lists and permissions, and confirm that no unexpected users, scheduled tasks, backup jobs, or remote access settings remain.

Typical attack path

1. Find internet-facing or reachable QNAP NAS devices running HBS 3.
2. Fingerprint QTS, QuTS hero, QuTScloud, and HBS 3 versions to identify vulnerable releases.
3. Send crafted unauthenticated requests that bypass HBS 3 authorization controls.
4. Establish an authenticated session or otherwise gain login-level access to the NAS.
5. Enumerate shared folders, backup jobs, users, snapshots, and stored credentials or tokens available to the compromised context.
6. Exfiltrate sensitive files or tamper with backup configurations.
7. Deploy ransomware or destructive tooling to encrypt, delete, or disrupt NAS-hosted data.
8. Attempt to remove traces from system, access, and application logs.

How to detect it

Review QNAP System Event Logs, QuLog Center entries, HBS 3 application logs, web access logs, authentication logs, SSH logs, and network telemetry for evidence of unauthenticated or suspicious access before the patch date. Focus on internet-facing NAS devices, especially those with logins or administrative activity from unfamiliar IP addresses, unusual session creation, unexpected HBS job changes, and bursts of file reads, writes, renames, deletions, or archive creation. For ransomware-driven activity, examine file shares for mass creation of encrypted archive files, ransom notes, deleted snapshots, disabled backup jobs, or sudden spikes in CPU and disk I/O from compression utilities. Also inspect account and configuration state for new users, privilege changes, enabled SSH, new scheduled tasks, modified remote access settings, or altered backup destinations. If logs are missing or truncated around the suspected window, treat that as suspicious and correlate with firewall, VPN, reverse proxy, EDR, and storage audit records.

• Hybrid Backup Sync
• HBS 3
• !!!READ_ME.txt
• *.7z
• 7z
• 7za
• 7zr
• /usr/local/sbin/7z
• /usr/bin/7z
• /share/*/.qpkg/HybridBackup
• /share/*/.qpkg/HybridBackupSync
• /mnt/HDA_ROOT/.logs
• /var/log/auth.log
• /var/log/httpd/access_log
• /var/log/httpd/error_log
• Failed password
• Accepted password
• login failed
• login success
• snapshot deleted
• backup job deleted
• backup job modified

What your security team should do

• Immediately inventory QNAP NAS devices and identify any running HBS 3 on affected QTS, QuTS hero, or QuTScloud versions.
• Patch affected HBS 3 installations to the applicable fixed version or later; treat internet-exposed systems as emergency changes.
• Remove direct public exposure of NAS management and HBS interfaces; require VPN, allowlisting, or segmented administrative access.
• Assume exposed unpatched systems may have been accessed and perform compromise assessment before relying on them for recovery.
• Review NAS user accounts, administrative sessions, SSH access, remote access settings, backup jobs, snapshots, and file integrity for unauthorized changes.
• Rotate passwords, API tokens, backup credentials, and any secrets stored on or used by the NAS after remediation.
• Check for ransomware indicators such as unexpected encrypted archives, ransom notes, abnormal compression activity, mass file modifications, or deleted snapshots.
• Ensure critical backups are offline, immutable, or stored separately from the NAS so compromise of the appliance does not compromise recovery.
• Create SIEM detections for unusual QNAP logins, failed or anomalous HBS requests, unexpected administrative changes, and bulk file modification activity.
• Because the vulnerability is in CISA KEV and has ransomware association, track remediation to closure and document risk acceptance for any device that cannot be upgraded.