FKIE_CVE-2021-26620

Vulnerability from fkie_nvd - Published: 2022-03-25 19:15 - Updated: 2024-11-21 05:56
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important information in the server by exploiting vulnerabilities such as insufficient authentication when accessing the shared folder and changing user’s passwords.
References
vuln@krcert.or.krhttps://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66578Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66578Third Party Advisory
Impacted products
Vendor Product Version
iptime nas101_firmware *
iptime nas101 -
iptime nas1dual_firmware *
iptime nas1dual -
iptime nas2dual_firmware *
iptime nas2dual -
iptime nas3_firmware *
iptime nas3 -
iptime nas4_firmware *
iptime nas4 -
iptime nas4dual_firmware *
iptime nas4dual -
iptime nas-i_firmware *
iptime nas-i -
iptime nas-ii_firmware *
iptime nas-ii -
iptime nas-iie_firmware *
iptime nas-iie -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:iptime:nas101_firmware:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "884756F6-7AD4-4427-A354-7C9428716CB8",
              "versionEndExcluding": "1.4.82",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:iptime:nas101:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B46EE9BB-2CA6-49E1-BB46-9621805C89A0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:iptime:nas1dual_firmware:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "0851FBDB-7C72-4072-9EA4-905F69C36CBC",
              "versionEndExcluding": "1.4.82",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:iptime:nas1dual:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2ACEC464-70B3-452B-A1A3-594C697E3AB3",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:iptime:nas2dual_firmware:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "047128B3-8F89-48F0-8982-3C51B6CFC769",
              "versionEndExcluding": "1.4.82",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:iptime:nas2dual:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "271D21D5-A55E-4D4F-8473-5A7A67573DEA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:iptime:nas3_firmware:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "CD158E92-E69D-47E8-BABA-16933160E1FE",
              "versionEndExcluding": "1.4.82",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:iptime:nas3:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "409E183B-5919-48FF-A121-EB89E58D1956",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:iptime:nas4_firmware:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "EE790ADF-B496-49CB-AF73-9612141DA38B",
              "versionEndExcluding": "1.4.82",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:iptime:nas4:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5681FB7D-A7F5-48F1-AE10-79F5B64081E5",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:iptime:nas4dual_firmware:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "80AC9D9F-57CF-4BAC-8988-FCE44F53C4E8",
              "versionEndExcluding": "1.4.82",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:iptime:nas4dual:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0429CC1A-B95C-4FB0-90D6-D6CAD8E1CC14",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:iptime:nas-i_firmware:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "06940CF1-703F-44E6-9078-B2F1E64EA745",
              "versionEndExcluding": "1.4.82",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:iptime:nas-i:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CBE26B68-CC6F-4ABE-818A-8872A0753DC6",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:iptime:nas-ii_firmware:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "78BDB206-048A-4D12-9AFC-36B06DFDD49F",
              "versionEndExcluding": "1.4.82",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:iptime:nas-ii:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C101E48-A4C0-418A-9FBD-AF6B9115B0A9",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:iptime:nas-iie_firmware:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "8410D8F2-D177-4A96-8BD4-F9A96ECE699A",
              "versionEndExcluding": "1.4.82",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:iptime:nas-iie:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B6F0961-E444-4519-BC03-9BFADEDF73EE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important information in the server by exploiting vulnerabilities such as insufficient authentication when accessing the shared folder and changing user\u2019s passwords."
    },
    {
      "lang": "es",
      "value": "Se ha detectado una vulnerabilidad de autenticaci\u00f3n inapropiada conllevando a un filtrado de informaci\u00f3n en iptime NAS2dual. Los atacantes remotos son capaces de robar informaci\u00f3n importante en el servidor al explotar vulnerabilidades como la autenticaci\u00f3n insuficiente cuando es accedida a la carpeta compartida y son cambiadas las contrase\u00f1as de usuarios"
    }
  ],
  "id": "CVE-2021-26620",
  "lastModified": "2024-11-21T05:56:36.370",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "vuln@krcert.or.kr",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-03-25T19:15:08.687",
  "references": [
    {
      "source": "vuln@krcert.or.kr",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66578"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66578"
    }
  ],
  "sourceIdentifier": "vuln@krcert.or.kr",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "vuln@krcert.or.kr",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.