CVEvulnerability

CVE-2021-26620

7.5 HIGH Published 2022-03-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-03-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-287

Description

An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important information in the server by exploiting vulnerabilities such as insufficient authentication when accessing the shared folder and changing user’s passwords.

Affected configurations

• iptime nas101 firmware (< 1.4.82) • iptime nas1dual firmware (< 1.4.82) • iptime nas2dual firmware (< 1.4.82) • iptime nas3 firmware (< 1.4.82) • iptime nas4 firmware (< 1.4.82) • iptime nas4dual firmware (< 1.4.82) • iptime nas-i firmware (< 1.4.82) • iptime nas-ii firmware (< 1.4.82) • iptime nas-iie firmware (< 1.4.82)

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References