CVE-2021-26620

Published: Mar 25, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important information in the server by exploiting vulnerabilities such as insufficient authentication when accessing the shared folder and changing user’s passwords.

Affected (9)

Products: Iptime: Nas101 Firmware, Nas1dual Firmware, Nas2dual Firmware, Nas3 Firmware, Nas4 Firmware, Nas4dual Firmware, Nas I Firmware, Nas Ii Firmware, Nas Iie Firmware

9 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Iptime Nas101 Firmware	Before 1.4.82

Running on/with	Platform Versions
Iptime Nas101	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Iptime Nas1dual Firmware	Before 1.4.82

Running on/with	Platform Versions
Iptime Nas1dual	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Iptime Nas2dual Firmware	Before 1.4.82

Running on/with	Platform Versions
Iptime Nas2dual	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Iptime Nas3 Firmware	Before 1.4.82

Running on/with	Platform Versions
Iptime Nas3	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Iptime Nas4 Firmware	Before 1.4.82

Running on/with	Platform Versions
Iptime Nas4	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Iptime Nas4dual Firmware	Before 1.4.82

Running on/with	Platform Versions
Iptime Nas4dual	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Iptime Nas I Firmware	Before 1.4.82

Running on/with	Platform Versions
Iptime Nas I	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Iptime Nas Ii Firmware	Before 1.4.82

Running on/with	Platform Versions
Iptime Nas Ii	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Iptime Nas Iie Firmware	Before 1.4.82

Running on/with	Platform Versions
Iptime Nas Iie	All versions

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66578

Source: vuln@krcert.or.kr

Third Party Advisory

https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66578

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.