CVE-2021-26620
IPTIME NAS2dual improper authentication vulnerability
- State
- Published
- Severity
- 7.5 High
- Published
- Mar 25, 2022
- Updated
- Aug 3, 2024
- Reserved
- Feb 3, 2021
Description
An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important information in the server by exploiting vulnerabilities such as insufficient authentication when accessing the shared folder and changing user’s passwords.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | krcert |
Weaknesses
- CWE-287 Improper Authentication
Affected Products
| Product | Versions |
|---|---|
ipTIME NAS product (NAS1, 2, 3, 4, 1dual, 2dual 4dual)EFM Networks Co., Ltd |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.