Read the docs
TI-2021-09804 Aliases CVE-2021-28813GHSA-v5xc-jmcq-c9fm

Insufficiently Protected Credentials Vulnerability in QSW-M2116P-2T2S and QuNetSwitch

Priority MEDIUM 43CWE-259Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Information disclosure
Confidentiality · integrity · availability
Low · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-259 and CWE-522.

Summary

A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuNetSwitch. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism.We have already fixed this vulnerability in the following versions: QSW-M2116P-2T2S 1.0.6 build 210713 and later QGD-1600P: QuNetSwitch 1.0.6.1509 and later QGD-1602P: QuNetSwitch 1.0.6.1509 and later QGD-3014PT: QuNetSwitch 1.0.6.1519 and later

Why it matters now

EPSS 0.01095 65th percentileScored 2026-11-07
Fix Fixed QSW-M2116P-2T2S (QNAP Systems Inc.): 1.0.6 build 210713QuNetSwitch (QNAP Systems Inc.): 1.0.6.1509, 1.0.6.1519

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQSW-M2116P-2T2Sbefore 1.0.6 build 2107131.0.6 build 210713Patch availableCNA
QNAPQuNetSwitchbefore 1.0.6.15091.0.6.1509Patch availableCNA
QNAPQuNetSwitchbefore 1.0.6.15091.0.6.1509Patch availableCNA
QNAPQuNetSwitchbefore 1.0.6.15191.0.6.1519Patch availableCNA
  • QSW-M2116P-2T2S VendorQNAP Affected before 1.0.6 build 210713 Fixed in 1.0.6 build 210713 Patch available CNA
  • QuNetSwitch VendorQNAP Affected before 1.0.6.1509 Fixed in 1.0.6.1509 Patch available CNA
  • QuNetSwitch VendorQNAP Affected before 1.0.6.1509 Fixed in 1.0.6.1509 Patch available CNA
  • QuNetSwitch VendorQNAP Affected before 1.0.6.1519 Fixed in 1.0.6.1519 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qsw-m2116p-2t2s_firmware:*:*:*:*:*:*:*:*before 1.0.6VulnerableQNAP
cpe:2.3:h:qnap:qsw-m2116p-2t2s:-:*:*:*:*:*:*:*not specified by NVDRunning onQNAP
cpe:2.3:a:qnap:qunetswitch:*:*:*:*:*:*:*:*before 1.0.6.1509VulnerableQNAP
cpe:2.3:h:qnap:qgd-1600p:-:*:*:*:*:*:*:*not specified by NVDRunning onQNAP
cpe:2.3:h:qnap:qgd-1602p:-:*:*:*:*:*:*:*not specified by NVDRunning onQNAP
cpe:2.3:h:qnap:qgd-3014pt:-:*:*:*:*:*:*:*not specified by NVDRunning onQNAP
  • cpe:2.3:o:qnap:qsw-m2116p-2t2s_firmware:*:*:*:*:*:*:*:* Versions before 1.0.6 Vulnerable ·QNAP
  • cpe:2.3:h:qnap:qsw-m2116p-2t2s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·QNAP
  • cpe:2.3:a:qnap:qunetswitch:*:*:*:*:*:*:*:* Versions before 1.0.6.1509 Vulnerable ·QNAP
  • cpe:2.3:h:qnap:qgd-1600p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·QNAP
  • cpe:2.3:h:qnap:qgd-1602p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·QNAP
  • cpe:2.3:h:qnap:qgd-3014pt:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·QNAP

Remediation

  • Fix · CNA QSW-M2116P-2T2S (QNAP Systems Inc.) Fixed in 1.0.6 build 210713
  • Fix · CNA QuNetSwitch (QNAP Systems Inc.) Fixed in 1.0.6.1509
  • Fix · CNA QuNetSwitch (QNAP Systems Inc.) Fixed in 1.0.6.1509
  • Fix · CNA QuNetSwitch (QNAP Systems Inc.) Fixed in 1.0.6.1519

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-28813
  2. 2026-10-03 Alias added: GHSA-v5xc-jmcq-c9fm

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences