High severity · published Mar 25, 2022
CVE-2021-26620
An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual
7.5
CVSS
1.4%
EPSS
No
On KEV
Description
An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important information in the server by exploiting vulnerabilities such as insufficient authentication when accessing the shared folder and changing user’s passwords.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NF
Nas-i Firmware · Iptime
before 1.4.82 · source: NVD
NF
Nas-ii Firmware · Iptime
before 1.4.82 · source: NVD
NF
Nas-iie Firmware · Iptime
before 1.4.82 · source: NVD
NF
Nas101 Firmware · Iptime
before 1.4.82 · source: NVD
NF
Nas1dual Firmware · Iptime
before 1.4.82 · source: NVD
NF
Nas2dual Firmware · Iptime
before 1.4.82 · source: NVD
NF
Nas3 Firmware · Iptime
before 1.4.82 · source: NVD
NF
Nas4 Firmware · Iptime
before 1.4.82 · source: NVD
NF
Nas4dual Firmware · Iptime
before 1.4.82 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-26620
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-26620
Third Party Advisory
https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66578
More from Nas-i Firmware
8.0
CVE-2020-7847
The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain remote code execution