CVE-2021-28799VulnerabilityPublished 03/31/2022Updated 10/24/2026

CVE-2021-28799: QNAP NAS Improper Authorization Vulnerability

Affects QNAP Network Attached Storage (NAS)Source CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/31/2022
KEV deadline: 04/21/2022
Ransomware: Used in ransomware campaigns
EPSS: 78.3% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-28799 (opens in a new tab)

Description

QNAP NAS devices running HBS 3 have an improper authorization vulnerability (CVE-2021-28799) that allows remote attackers to log in without proper credentials. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. The issue relates to insufficient access control, enabling unauthorized access to the device.

Summary

CVE-2021-28799 is an improper authorization vulnerability in QNAP NAS devices running HBS 3. It permits remote attackers to bypass authentication controls and log in to the device. The vulnerability is classified under CWE-285 (Improper Authorization). Exploitation of this flaw has been observed in the wild, including use in ransomware campaigns targeting affected devices.

Impact

Successful exploitation allows remote attackers to gain unauthorized access to QNAP NAS devices, potentially leading to data compromise, device control, and facilitation of ransomware attacks. This poses a high risk to confidentiality, integrity, and availability of data stored on affected devices.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the NAS device, especially from untrusted networks, and monitor for suspicious login attempts. Follow QNAP's official security advisories for updates and apply patches promptly once released.

Weaknesses

CWE-285Improper Authorization (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:25:28 UTC

Weaknesses

References

Related threats