title: Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)
description: An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .
problem types: CWE-285 Improper Authorization
affected:
{
platforms: QTS 4.5.2
product: HBS 3
vendor: QNAP Systems Inc.
versions:
lessThan: v16.0.0415, status: affected, version: unspecified, versionType: custom
}
{
platforms: QTS 4.3.6
product: HBS 3
vendor: QNAP Systems Inc.
versions:
lessThan: v3.0.210412, status: affected, version: unspecified, versionType: custom
}
{
platforms: QTS 4.3.4
product: HBS 3
vendor: QNAP Systems Inc.
versions:
lessThan: v3.0.210411, status: affected, version: unspecified, versionType: custom
}
{
platforms: QTS 4.3.3
product: HBS 3
vendor: QNAP Systems Inc.
versions:
lessThan: v3.0.210411, status: affected, version: unspecified, versionType: custom
}
{
platforms: QuTS hero h4.5.1
product: HBS 3
vendor: QNAP Systems Inc.
versions:
lessThan: v16.0.0419, status: affected, version: unspecified, versionType: custom
}
{
platforms: QuTScloud c4.5.1~c4.5.4
product: HBS 3
vendor: QNAP Systems Inc.
versions:
lessThan: v16.0.0419, status: affected, version: unspecified, versionType: custom
}
{
product: HBS 2
vendor: QNAP Systems Inc.
versions:
status: unaffected, version: all versions
}
{
product: HBS 1.3
vendor: QNAP Systems Inc.
versions:
status: unaffected, version: all versions
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
solutions: QNAP have already fixed this vulnerability in the following versions of HBS 3:
QTS 4.5.2: HBS 3 v16.0.0415 and later
QTS 4.3.6: HBS 3 v3.0.210412 and later
QTS 4.3.3 and 4.3.4: HBS 3 v3.0.210411 and later
QuTS hero h4.5.1: HBS 3 v16.0.0419 and later
QuTScloud c4.5.1~c4.5.4: HBS 3 v16.0.0419 and later