Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- Fix
- Fixed in v16.0.0415, v3.0.210412, v3.0.210411, v16.0.0419
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The vulnerability affects QNAP NAS devices running the HBS 3 (Hybrid Backup Sync) application, which is used for backing up and syncing data. If exploited, it could allow remote attackers to log in to an affected device without proper authorization.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- QNAP Systems Inc. HBS 3
From unspecified · fixed in v16.0.0415
- QNAP Systems Inc. HBS 3
From unspecified · fixed in v3.0.210412
- QNAP Systems Inc. HBS 3
From unspecified · fixed in v3.0.210411
- QNAP Systems Inc. HBS 3
From unspecified · fixed in v3.0.210411
- QNAP Systems Inc. HBS 3
From unspecified · fixed in v16.0.0419
- QNAP Systems Inc. HBS 3
From unspecified · fixed in v16.0.0419
- QNAP Systems Inc. HBS 2
Version range not reported
- QNAP Systems Inc. HBS 1.3
Version range not reported