Vulnerability · Published Sep 10, 2021 · Assigned by qnap

CVE-2021-28813Insufficiently Protected Credentials Vulnerability in QSW-M2116P-2T2S and QuNetSwitch

Critical 9.6

In plain English

A critical-severity hard-coded credentials in QSW-M2116P-2T2S from QNAP Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).

Severity (CVSS 3.1)9.6Critical

Exploit odds (30 days)1.1%top 34.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuNetSwitch. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism.We have already fixed this vulnerability in the following versions: QSW-M2116P-2T2S 1.0.6 build 210713 and later QGD-1600P: QuNetSwitch 1.0.6.1509 and later QGD-1602P: QuNetSwitch 1.0.6.1509 and later QGD-3014PT: QuNetSwitch 1.0.6.1519 and later

Affected products (as reported)

Vendor	Product	Versions
QNAP Systems Inc.	QSW-M2116P-2T2S	unspecified – before 1.0.6 build 210713
QNAP Systems Inc.	QuNetSwitch	unspecified – before 1.0.6.1509
QNAP Systems Inc.	QuNetSwitch	unspecified – before 1.0.6.1509
QNAP Systems Inc.	QuNetSwitch	unspecified – before 1.0.6.1519

Weakness: CWE-259, CWE-798, CWE-522 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

References

https://www.qnap.com/en/security-advisory/qsa-21-37 x_refsource_MISC