High severity7.5NVD Advisory· Published Mar 25, 2022· Updated Jun 17, 2026

CVE-2021-26620

Description

An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important information in the server by exploiting vulnerabilities such as insufficient authentication when accessing the shared folder and changing user’s passwords.

Affected products

Iptime/Nas I Firmware
cpe:2.3:o:iptime:nas-i_firmware:*:*:*:*:*:windows:*:*
Range: <1.4.82
Iptime/Nas Ii Firmware
cpe:2.3:o:iptime:nas-ii_firmware:*:*:*:*:*:windows:*:*
Range: <1.4.82
Iptime/Nas Iie Firmware
cpe:2.3:o:iptime:nas-iie_firmware:*:*:*:*:*:windows:*:*
Range: <1.4.82
Iptime/Nas101 Firmware
cpe:2.3:o:iptime:nas101_firmware:*:*:*:*:*:windows:*:*
Range: <1.4.82
Iptime/Nas1dual Firmware
cpe:2.3:o:iptime:nas1dual_firmware:*:*:*:*:*:windows:*:*
Range: <1.4.82
Iptime/Nas2dual Firmware
cpe:2.3:o:iptime:nas2dual_firmware:*:*:*:*:*:windows:*:*
Range: <1.4.82
Iptime/Nas3 Firmware
cpe:2.3:o:iptime:nas3_firmware:*:*:*:*:*:windows:*:*
Range: <1.4.82
Iptime/Nas4 Firmware
cpe:2.3:o:iptime:nas4_firmware:*:*:*:*:*:windows:*:*
Range: <1.4.82
Iptime/Nas4dual Firmware
cpe:2.3:o:iptime:nas4dual_firmware:*:*:*:*:*:windows:*:*
Range: <1.4.82
Iptime/NAS2dualllm-fuzzy
EFM Networks Co., Ltd/ipTIME NAS product (NAS1, 2, 3, 4, 1dual, 2dual 4dual)v5
Range: unspecified

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

CVE-2021-26620

Description

Affected products

Patches

Vulnerability mechanics

References

News mentions