PT-2021-3649 · Hbs 3 · Hbs 3

Ta-Lun Yen · Published 2021-05-05 · Updated 2021-07-12 · CVE-2021-28809

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HBS 3 versions prior to v3.0.210506 HBS 3 versions prior to v3.0.210507

Description An improper access control issue has been reported, affecting certain legacy versions of HBS 3. This issue allows attackers to compromise the security of the operating system. The vulnerability is related to insufficient authentication procedures on the RTSS server, which can be exploited by a remote attacker to elevate privileges using a specially crafted request on port 8899.

Recommendations For HBS 3 versions prior to v3.0.210506, update to HBS 3 v3.0.210506 or later. For HBS 3 versions prior to v3.0.210507, update to HBS 3 v3.0.210507 or later. As a temporary workaround, consider restricting access to port 8899 to minimize the risk of exploitation.

Fix

Missing Authentication

Improper Access Control

Weakness Enumeration

CWE-306

CWE-284

CWE-749

Related Identifiers

BDU:2021-03868

CVE-2021-28809

ZDI-21-783

Affected Products

Hbs 3

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2021-28809 · Security Note
• https://qnap.com/en/security-advisory/qsa-21-19 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03868 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-783 · Security Note
• https://osv.dev/vulnerability/CVE-2021-28809 · Vendor Advisory
• https://t.me/cibsecurity/25995 · Telegram Post
• https://securitylab.ru/news/521969.php · Note
• https://cybersecurity-help.cz/vdb/SB2021070508 · Note
• https://t.me/true_secator/1893 · Telegram Post