by Kastro
Paper/Archive/CVE-2021-38679

CVE-2021-38679

QNAP Systems Inc. Kazoo Server — Improper Authentication in Kazoo Server

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 54.7.547 × 2010.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An improper authentication vulnerability has been reported to affect QNAP NAS running Kazoo Server. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Kazoo Server: Kazoo Server 4.11.22 and later

Affected

ProductAffectedFixed inSource
Kazoo Serverunspecified – < 4.11.224.11.22CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qnap (CNA)6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

refqnap.com/en/security-advisory/qsa-22-01