VulnRadar

Data against noise.

Page generated: 08 Nov 2026, 12:53 UTC

CVE-2021-28799

Read full description

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

CVSS 10.0 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

1.6/10

REALITY · THREAT PRIORITY

8.9/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 10: +1.50
Fresh EPSS: 78.25%: +0.39

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 11 documents and public datasets.

Hype components

Headline sample (25%)

50/100

Press, 30 days (60%)

5/100

Grounded branding (15%)

0/100

HYPE TOTAL16/100

Sources and documents

news.lavx.hu

Press · 03 Nov 2026, 08:32 · Synology urges NAS updates after ransomware exploits patched DSM flaw - news.lavx.hu

Unit 42

Press · 24 Feb 2022, 08:00 · SockDetour – a Silent, Fileless, Socketless Backdoor – Targets U.S. Defense Contractors - Unit 42

ET CIO

Press · 28 Jan 2022, 08:00 · Hackers are Increasingly Targeting Zero-Day Vulnerabilities and Supply Chain Networks for Maximum Impact, st.. - ET CIO

BleepingComputer

Press · 15 Jan 2022, 08:00 · Qlocker ransomware returns to target QNAP NAS devices worldwide - BleepingComputer

Help Net Security

Press · 17 Aug 2021, 07:00 · NAS devices under attack: How to keep them safe? - Help Net Security

See all 11 source documents

Neowin

Press · 10 Aug 2021, 07:00 · New eCh0raix ransomware variant attacks both QNAP and Synology NAS devices - Neowin

BleepingComputer

Press · 10 Aug 2021, 07:00 · eCh0raix ransomware now targets both QNAP and Synology NAS devices - BleepingComputer

Unit 42

Press · 10 Aug 2021, 07:00 · New eCh0raix Ransomware Variant Targets QNAP and Synology Network-Attached Storage Devices - Unit 42

BleepingComputer

Press · 21 May 2021, 07:00 · QNAP confirms Qlocker ransomware used HBS backdoor account - BleepingComputer

Help Net Security

Press · 26 Apr 2021, 07:00 · QNAP NAS devices under ransomware attack - Help Net Security

BleepingComputer

Press · 22 Apr 2021, 07:00 · QNAP removes backdoor account in NAS backup, disaster recovery app - BleepingComputer

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

━ Hype Score (Perceived) ━ Reality threat priority. Definition changes are not new attacks.

Public exploit evidence

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 10; EPSS 78.2%
Attention, last 30 days: 1 distinct story titles; 1 press documents; 1 publisher domains.
Technical potential: network access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:58:25.853394+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

First press mention

22 Apr 2021, 07:00

Published

13 May 2021, 02:55

Added to the CISA KEV catalog

31 Mar 2022, 00:00

Latest press mention

03 Nov 2026, 08:32

Score calculated

05 Nov 2026, 13:58