Lucene search

[email protected]CVE-2021-28813

HistorySep 10, 2021 - 4:15 a.m.

CVE-2021-28813

2021-09-1004:15:16

CWE-798

CWE-259

CWE-922

CWE-522

[email protected]

web.nvd.nist.gov

cve-2021-28813

vulnerability

qnap switches

qunetswitch

insecure storage

sensitive information

remote attack

nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

9.6 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

7.3 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.4%

JSON

A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuNetSwitch. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism.We have already fixed this vulnerability in the following versions: QSW-M2116P-2T2S 1.0.6 build 210713 and later QGD-1600P: QuNetSwitch 1.0.6.1509 and later QGD-1602P: QuNetSwitch 1.0.6.1509 and later QGD-3014PT: QuNetSwitch 1.0.6.1519 and later

Affected configurations

NVD

Node

qnapqsw-m2116p-2t2s_firmwareRange<1.0.6

AND

qnapqsw-m2116p-2t2sMatch-

Node

qnapqunetswitchRange<1.0.6.1509

AND

qnapqgd-1600pMatch-

qnapqgd-1602pMatch-

qnapqgd-3014ptMatch-

CPENameOperatorVersion
qnap:qsw-m2116p-2t2s_firmwareqnap qsw-m2116p-2t2s firmwarelt1.0.6

CPE	Name	Operator	Version
qnap:qsw-m2116p-2t2s_firmware	qnap qsw-m2116p-2t2s firmware	lt	1.0.6

CNA Affected

[
  {
    "product": "QSW-M2116P-2T2S",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "1.0.6 build 210713",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QGD-1600P"
    ],
    "product": "QuNetSwitch",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "1.0.6.1509",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QGD-1602P"
    ],
    "product": "QuNetSwitch",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "1.0.6.1509",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QGD-3014PT"
    ],
    "product": "QuNetSwitch",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "1.0.6.1519",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.qnap.com/en/security-advisory/qsa-21-37

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

9.6 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

7.3 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.4%

JSON

Related for CVE-2021-28813

cvelist1 prion1 nvd1