# CVE-2021-28799: QNAP NAS HBS 3 - Information Disclosure

> Live exploitation tracking for CVE-2021-28799 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-28799

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** QNAP Systems Inc. HBS 3, QNAP Systems Inc. HBS 2, QNAP Systems Inc. HBS 1.3
- **Weaknesses:** CWE-285 (Improper Authorization)
- **Tags:** nas, file_sharing

## Description

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

## CrowdSec analysis

[CVE-2021-28799](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-28799) is a critical improper authorization vulnerability in QNAP HBS 3, allowing remote attackers to log in to affected NAS devices without authentication. Exploitation of this flaw could lead to full compromise of the device, resulting in unauthorized access, data theft, or further attacks on the network. This vulnerability poses a severe risk, as it enables attackers to bypass security controls and potentially exfiltrate sensitive information or disrupt backup operations.

CrowdSec has been tracking this vulnerability and its exploits since 14th of January 2026.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2021-28799 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
CrowdSec network telemetry also shows that exploitation of CVE-2021-28799 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit this vulnerability by sending crafted POST requests to the `/cgi-bin/backup/hbs_mgnt.cgi` endpoint, attempting to execute unauthorized commands and access sensitive files without proper authentication.

## Timeline

- 2021-05-13: CVE Published. CVE-2021-28799 is published to NVD.
- 2022-03-31: CISA KEV. CVE-2021-28799 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2022-04-21: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2026-01-14: Rule Released. CrowdSec releases a rule to detect CVE-2021-28799 exploitation attempts against the CrowdSec Network.
- 2026-01-19: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-28799 for the first time.

## References

- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28799.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-28799) follows observed exploitation activity for CVE-2021-28799. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.