CVE-2021-28813: qnap systems inc. qsw-m2116p-2t2s Use of Hard-coded Password

Vulnerability summary

CVE-2021-28813 is a critical (CVSS 9.6) Use of Hard-coded Password vulnerability in qnap systems inc. qsw-m2116p-2t2s. EPSS estimates a 1.09% chance of exploitation in the next 30 days, higher than 65.2% of scored vulnerabilities.

Timeline

1. 10-09-2021
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuNetSwitch. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism.We have already fixed this vulnerability in the following versions: QSW-M2116P-2T2S 1.0.6 build 210713 and later QGD-1600P: QuNetSwitch 1.0.6.1509 and later QGD-1602P: QuNetSwitch 1.0.6.1509 and later QGD-3014PT: QuNetSwitch 1.0.6.1519 and later

• CWE-259Use of Hard-coded PasswordThe product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
• CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
• CWE-798Use of Hard-coded CredentialsThe product contains hard-coded credentials, such as a password or cryptographic key.
• CWE-922Insecure Storage of Sensitive InformationThe product stores sensitive information without properly limiting read or write access by unauthorized actors.