← Back

CVE-2021-28805

nvd nist
Published: Jun 11, 2021Modified: Jun 17, 2026

JSON object

Loading...
5.5
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 1.8 / Impact: 3.6
Source: NVD

Description

Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read application data. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.3 build 20210505 on QSW-M2108-2C; versions prior to 1.0.3 build 20210505 on QSW-M2108-2S; versions prior to 1.0.3 build 20210505 on QSW-M2108R-2C; versions prior to 1.0.12 build 20210506 on QSW-M408.

Affected (2)

Products: Qnap: Qss
Qnap
1 product
Qss
Configuration A
1 vulnerable · 3 platform
Vulnerable SoftwareAffected Versions
Qss
Before 1.0.3
Running on/withPlatform Versions
Qnap
Qsw M2108 2c
All versions
Qnap
Qsw M2108 2s
All versions
Qnap
Qsw M2108r 2c
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Qss
Before 1.0.12
Running on/withPlatform Versions
Qnap
Qsw M408
All versions

Related CWEs

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-540
Inclusion of Sensitive Information in Source Code
Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.

References (2)

Source: security@qnapsecurity.com.tw
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.