Lucene search

[email protected]CVE-2021-26620

HistoryMar 25, 2022 - 7:15 p.m.

CVE-2021-26620

2022-03-2519:15:00

CWE-287

[email protected]

web.nvd.nist.gov

cve-2021-26620

iptime

nas2dual

improper authentication

information leakage

vulnerability

remote attackers

shared folder

password change

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.7 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

60.7%

JSON

An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important information in the server by exploiting vulnerabilities such as insufficient authentication when accessing the shared folder and changing user’s passwords.

CPENameOperatorVersion
iptime:nas101_firmwareiptime nas101 firmwarelt1.4.82
iptime:nas1dual_firmwareiptime nas1dual firmwarelt1.4.82
iptime:nas2dual_firmwareiptime nas2dual firmwarelt1.4.82
iptime:nas3_firmwareiptime nas3 firmwarelt1.4.82
iptime:nas4_firmwareiptime nas4 firmwarelt1.4.82
iptime:nas4dual_firmwareiptime nas4dual firmwarelt1.4.82
iptime:nas-i_firmwareiptime nas-i firmwarelt1.4.82
iptime:nas-ii_firmwareiptime nas-ii firmwarelt1.4.82
iptime:nas-iie_firmwareiptime nas-iie firmwarelt1.4.82

CPE	Name	Operator	Version
iptime:nas101_firmware	iptime nas101 firmware	lt	1.4.82
iptime:nas1dual_firmware	iptime nas1dual firmware	lt	1.4.82
iptime:nas2dual_firmware	iptime nas2dual firmware	lt	1.4.82
iptime:nas3_firmware	iptime nas3 firmware	lt	1.4.82
iptime:nas4_firmware	iptime nas4 firmware	lt	1.4.82
iptime:nas4dual_firmware	iptime nas4dual firmware	lt	1.4.82
iptime:nas-i_firmware	iptime nas-i firmware	lt	1.4.82
iptime:nas-ii_firmware	iptime nas-ii firmware	lt	1.4.82
iptime:nas-iie_firmware	iptime nas-iie firmware	lt	1.4.82

References

www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66578

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.7 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

60.7%

JSON

Related for CVE-2021-26620

cvelist1 prion1