High severity · published Mar 25, 2022
CVE-2021-26620
IPTIME NAS2dual improper authentication vulnerability
7.5
CVSS
1.4%
EPSS
No
On KEV
Description
An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important information in the server by exploiting vulnerabilities such as insufficient authentication when accessing the shared folder and changing user’s passwords.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
ipTIME NAS product (NAS1, 2, 3, 4, 1dual, 2dual 4dual) · EFM Networks Co., Ltd
before 1.4.82 · source: vendor
NF
Nas-i Firmware · Iptime
before 1.4.82 · source: NVD
NF
Nas-ii Firmware · Iptime
before 1.4.82 · source: NVD
NF
Nas-iie Firmware · Iptime
before 1.4.82 · source: NVD
NF
Nas101 Firmware · Iptime
before 1.4.82 · source: NVD
NF
Nas1dual Firmware · Iptime
before 1.4.82 · source: NVD
NF
Nas2dual Firmware · Iptime
before 1.4.82 · source: NVD
NF
Nas3 Firmware · Iptime
before 1.4.82 · source: NVD
NF
Nas4 Firmware · Iptime
before 1.4.82 · source: NVD
NF
Nas4dual Firmware · Iptime
before 1.4.82 · source: NVD
Affected product
IN
ipTIME NAS product (NAS1, 2, 3, 4, 1dual, 2dual 4dual)
EFM Networks Co., Ltd