Qnap Qunetswitch vulnerabilities

5 vulnerabilities

Known vulnerabilities in Qnap Qunetswitch, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.6CVE-2021-28813qnap systems inc.qsw-m2116p-2t2s+3
EPSS score
1.09%
A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuNetSwitch. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism.We have already fixed this vulnerability in the following versions: QSW-M2116P-2T2S 1.0.6 build 210713 and later QGD-1600P: QuNetSwitch 1.0.6.1509 and later QGD-1602P: QuNetSwitch 1.0.6.1509 and later QGD-3014PT: QuNetSwitch 1.0.6.1519 and later9.8CVE-2026-22900qnap systems inc.qunetswitch+1
EPSS score
0.33%
A use of hard-coded credentials vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to gain unauthorized access. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906 and later6.7CVE-2026-22902qnap systems inc.qunetswitch+1
EPSS score
0.47%
A command injection vulnerability has been reported to affect QuNetSwitch. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906 and later9.8CVE-2026-22901qnap systems inc.qunetswitch+1
EPSS score
0.99%
A command injection vulnerability has been reported to affect QuNetSwitch. If a remote attacker gains a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906 and later9.8CVE-2026-22897qnap systems inc.qunetswitch+1
EPSS score
1.08%
A command injection vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.4.0415 and later