Hard-coded Password Vulnerability in QES
CVE-2020-2499

6.3MEDIUM

Key Information:

Vendor
QNAP
Status
Qes
Vendor
CVE Published:
23 December 2020

Summary

A hard-coded password vulnerability has been reported to affect earlier versions of QES. If exploited, this vulnerability could allow attackers to log in with a hard-coded password. QNAP has already fixed the issue in QES 2.1.1 Build 20200515 and later.

Affected Version(s)

QES build 20200515 < 2.1.1

References

https://www.qnap.com/zh-tw/security-advisory/qsa-20-19
x_refsource_MISC

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lodestone Security
.