CVE-2021-28809CWE-284CWE-306CWE-749

Missing Authentication for Critical Function in RTRR Server in HBS3

Critical · published July 8, 2021

CVSS v3.1
9.8
EPSS
16%
Percentile
96.9
In the wild
Unconfirmed
What it is

🚨 An improperly controlled access flaw in HBS 3 could expose your entire operating system! 🔥 Think of it like a hotel that has a keycard system but forgot to check who could access the penthouse suites — if an intruder gets a hold of a keycard, they can waltz right into the VIP area without breaking a sweat! If exploited, this vulnerability opens the door for attackers to gain unauthorized access to sensitive information, potentially leading to data theft or system compromise. The stakes are high, and the consequences could be absolutely devastating for your organization. Don't let this be the weak link in your security chain!

Put simply

Think of it like a hotel that has a keycard system but forgot to check who could access the penthouse suites — if an intruder gets a hold of a keycard, they can waltz right into the VIP area without breaking a sweat! This improper access control vulnerability in certain legacy versions of HBS 3 allows attackers to bypass security measures and gain unauthorized access to the operating system, compromising its integrity.

What to do

If exploited, this vulnerability opens the door for attackers to gain unauthorized access to sensitive information, potentially leading to data theft or system compromise. The stakes are high, and the consequences could be absolutely devastating for your organization. Don't let this be the weak link in your security chain! To safeguard your systems, urgently update to HBS 3 version 3.0.210507 or later if you're on QTS 4.3.6, or versions 3.0.210506 or later for QTS 4.3.4 and 4.3.3. Don't wait — patch these vulnerabilities now to protect your data! You've got this! Take these steps today, and you'll enhance your security in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.16093 · 96.9th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-306 · Missing Authentication for Critical Function; CWE-749 · Exposed Dangerous Method or Function
Published
2021-07-08T07:40Z
EPSS history
Timeline
  • 08 JUL 07:40Z
    Missing Authentication for Critical Function in RTRR Server in HBS3
    cvelistv5