by Kastro
Paper/Archive/CVE-2021-28813

CVE-2021-28813

QNAP Systems Inc. QSW-M2116P-2T2S — Insufficiently Protected Credentials Vulnerability in QSW-M2116P-2T2S and QuNetSwitch

EPSS 1%CVSS 9.6
critical.is priorityof 100
42
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 65.5.655 × 2013.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuNetSwitch. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism.We have already fixed this vulnerability in the following versions: QSW-M2116P-2T2S 1.0.6 build 210713 and later QGD-1600P: QuNetSwitch 1.0.6.1509 and later QGD-1602P: QuNetSwitch 1.0.6.1509 and later QGD-3014PT: QuNetSwitch 1.0.6.1519 and later

Affected

ProductAffectedFixed inSource
QSW-M2116P-2T2Sunspecified – < 1.0.6 build 2107131.0.6 build 210713CNA
QuNetSwitchunspecified – < 1.0.6.15091.0.6.1509CNA
QuNetSwitchunspecified – < 1.0.6.15091.0.6.1509CNA
QuNetSwitchunspecified – < 1.0.6.15191.0.6.1519CNA

Scores by source

qnap (CNA)9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

References

refqnap.com/en/security-advisory/qsa-21-37