by Kastro
Paper/Archive/CVE-2021-28809

CVE-2021-28809

QNAP Systems Inc. HBS 3 — Missing Authentication for Critical Function in RTRR Server in HBS3

EPSS 16%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 96.9.969 × 2019.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An improper access control vulnerability has been reported to affect certain legacy versions of HBS 3. If exploited, this vulnerability allows attackers to compromise the security of the operating system.QNAP have already fixed this vulnerability in the following versions of HBS 3: QTS 4.3.6: HBS 3 v3.0.210507 and later QTS 4.3.4: HBS 3 v3.0.210506 and later QTS 4.3.3: HBS 3 v3.0.210506 and later

Affected

ProductAffectedFixed inSource
HBS 3unspecified – < v3.0.210507v3.0.210507CNA
HBS 3unspecified – < v3.0.210506v3.0.210506CNA
HBS 3unspecified – < v3.0.210506v3.0.210506CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qnap (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refqnap.com/en/security-advisory/qsa-21-19refzerodayinitiative.com/advisories/ZDI-21-783