PT-2021-4456 · Qnap · Qutscloud+3

Zuso Art · Published 2021-05-12 · Updated 2026-01-10 · CVE-2021-28799

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HBS 3 versions prior to v16.0.0415 on QTS 4.5.2 HBS 3 versions prior to v3.0.210412 on QTS 4.3.6 HBS 3 versions prior to v3.0.210411 on QTS 4.3.4 HBS 3 versions prior to v3.0.210411 on QTS 4.3.3 HBS 3 versions prior to v16.0.0419 on QuTS hero h4.5.1 HBS 3 versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4

Description The issue is related to an improper authorization vulnerability in QNAP NAS running HBS 3, which can allow remote attackers to log in to a device. This vulnerability has been exploited in real-world incidents, including a ransomware campaign known as Qlocker, which targeted QNAP NAS devices. The campaign started in April 2021 and allowed attackers to encrypt files on the devices, demanding a ransom in exchange for the decryption key. A new version of the Qlocker ransomware, QLocker2, was discovered in January, which also exploits this vulnerability. It is estimated that hundreds of devices have been affected by these campaigns.

Recommendations For HBS 3 versions prior to v16.0.0415 on QTS 4.5.2, update to version v16.0.0415 or later. For HBS 3 versions prior to v3.0.210412 on QTS 4.3.6, update to version v3.0.210412 or later. For HBS 3 versions prior to v3.0.210411 on QTS 4.3.4, update to version v3.0.210411 or later. For HBS 3 versions prior to v3.0.210411 on QTS 4.3.3, update to version v3.0.210411 or later. For HBS 3 versions prior to v16.0.0419 on QuTS hero h4.5.1, update to version v16.0.0419 or later. For HBS 3 versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4, update to version v16.0.0419 or later. As a temporary workaround, consider restricting access to the HBS 3 application until a patch is available.

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

BDU:2021-05089

CVE-2021-28799

Affected Products

Hbs 3

Qts

Quts Hero

Qutscloud

References · 13

• https://osv.dev/vulnerability/CVE-2021-28799 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28799 · Security Note
• https://bdu.fstec.ru/vul/2021-05089 · Security Note
• https://qnap.com/en/security-advisory/QSA-21-13 · Vendor Advisory
• https://twitter.com/GreyNoiseIO/status/1836836063358370211 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799 · Note
• https://t.me/cvenotify/14343 · Telegram Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://t.me/malwr/5064 · Telegram Post
• https://twitter.com/rst_cloud/status/1837592477315784965 · Twitter Post
• https://t.me/true_secator/2524 · Telegram Post
• https://twitter.com/NTKramer/status/1744444948311592985 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/2009943331263132130 · Twitter Post