CVE-2021-28805: qnap systems inc. qss
Vulnerability summary
CVE-2021-28805 is a high (CVSS 7.8) vulnerability in qnap systems inc. qss. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 13.9% of scored vulnerabilities.
Timeline
- 11-06-2021PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read application data. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.3 build 20210505 on QSW-M2108-2C; versions prior to 1.0.3 build 20210505 on QSW-M2108-2S; versions prior to 1.0.3 build 20210505 on QSW-M2108R-2C; versions prior to 1.0.12 build 20210506 on QSW-M408.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.24%
Chance of exploitation in the next 30 days
Percentile
14%
Versus all other CVEs
30-day change
0.00 pp
From 0.24% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-540Inclusion of Sensitive Information in Source CodeSource code on a web server or repository often contains sensitive information and should generally not be accessible to users.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Qnap1 product
- qss< 1.0.3 | < 1.0.12
Qnap systems inc.1 product
- qss≥ unspecified, < 1.0.3 build 20210505 | ≥ unspecified, < 1.0.12 build 20210506
2 vendors · 2 products