CVE-2021-28798

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to modify files that impact system integrity. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.2.1630 Build 20210406 and later QTS 4.3.6.1663 Build 20210504 and later QTS 4.3.3.1624 Build 20210416 and later QuTS hero h4.5.2.1638 Build 20210414 and later QNAP NAS running QTS 4.5.3 are not affected.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-23CWE-284CWE-22

Affected software

No affected versions have been published.

Timeline

Published
May 21, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-287999.8An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerabCVE-2021-288009.8A command injection vulnerability has been reported to affect QNAP NAS running legacy versions of QTS. If exploited, this vulnerability alloCVE-2021-288017.5An out-of-bounds read vulnerability has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows aCVE-2021-288029.8A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to exeCVE-2021-288035.4This issue affects: QNAP Systems Inc. Q'center versions prior to 1.11.1004.CVE-2021-288049.8A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to exeCVE-2021-288055.5Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnCVE-2021-288065.4A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackCVE-2021-288075.4A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability alCVE-2021-288099.8An improper access control vulnerability has been reported to affect certain legacy versions of HBS 3. If exploited, this vulnerability alloCVE-2021-288107.5If exploited, this vulnerability allows an attacker to access resources which are not otherwise accessible without proper authentication. RoCVE-2021-288117.2If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. Roon Labs has already fixed this
CVE-2021-28798: High severity, CVSS 7.5 | Vulnix