Log in Start free

Vulnerability · Published Jun 11, 2021 · Assigned by qnap

CVE-2021-28805Inclusion of Sensitive Information in QSS

High 7.8

In plain English

A high-severity security flaw in QSS from QNAP Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 85.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read application data. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.3 build 20210505 on QSW-M2108-2C; versions prior to 1.0.3 build 20210505 on QSW-M2108-2S; versions prior to 1.0.3 build 20210505 on QSW-M2108R-2C; versions prior to 1.0.12 build 20210506 on QSW-M408.

Affected products (as reported)

VendorProductVersions
QNAP Systems Inc. QSS unspecified – before 1.0.3 build 20210505
QNAP Systems Inc. QSS unspecified – before 1.0.3 build 20210505
QNAP Systems Inc. QSS unspecified – before 1.0.3 build 20210505
QNAP Systems Inc. QSS unspecified – before 1.0.12 build 20210506

Weakness: CWE-540 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References