CVE-2021-28815

MEDIUM

6.0

Description

Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism. This issue affects: QNAP Systems Inc. myQNAPcloud Link versions prior to 2.2.21 on QTS 4.5.3; versions prior to 2.2.21 on QuTS hero h4.5.2; versions prior to 2.2.21 on QuTScloud c4.5.4.

CVE Details

CVSS v3.1 Score6.0

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Attack VectorLOCAL

ComplexityLOW

Privileges RequiredHIGH

User InteractionNONE

Published6/16/2021

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

qnap:myqnapcloud_linkqnap:qtsqnap:quts_heroqnap:qutscloud

Weaknesses (CWE)

CWE-922

References

https://www.qnap.com/zh-tw/security-advisory/qsa-21-26(security@qnapsecurity.com.tw)

https://www.qnap.com/zh-tw/security-advisory/qsa-21-26(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.