Insecure Storage of Sensitive Information in myQNAPcloud Link
Priority LOW 30CWE-922Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-922.
Summary
Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism. This issue affects: QNAP Systems Inc. myQNAPcloud Link versions prior to 2.2.21 on QTS 4.5.3; versions prior to 2.2.21 on QuTS hero h4.5.2; versions prior to 2.2.21 on QuTScloud c4.5.4.
Why it matters now
EPSS 0.01726 77th percentileScored 2026-11-07
Fix Fixed myQNAPcloud Link (QNAP Systems Inc.): 2.2.21
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| QNAP | myQNAPcloud Link | before 2.2.21 | 2.2.21 | Patch available | CNA |
| QNAP | myQNAPcloud Link | before 2.2.21 | 2.2.21 | Patch available | CNA |
| QNAP | myQNAPcloud Link | before 2.2.21 | 2.2.21 | Patch available | CNA |
- myQNAPcloud Link VendorQNAP Affected before 2.2.21 Fixed in 2.2.21 Patch available CNA
- myQNAPcloud Link VendorQNAP Affected before 2.2.21 Fixed in 2.2.21 Patch available CNA
- myQNAPcloud Link VendorQNAP Affected before 2.2.21 Fixed in 2.2.21 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:qnap:myqnapcloud_link:*:*:*:*:*:*:*:* | before 2.2.21 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.5.3:-:*:*:*:*:*:* | 4.5.3 | Running on | QNAP |
| cpe:2.3:o:qnap:quts_hero:h4.5.2:-:*:*:*:*:*:* | h4.5.2 | Running on | QNAP |
| cpe:2.3:o:qnap:qutscloud:c4.5.4:-:*:*:*:*:*:* | c4.5.4 | Running on | QNAP |
- cpe:2.3:a:qnap:myqnapcloud_link:*:*:*:*:*:*:*:* Versions before 2.2.21 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.5.3:-:*:*:*:*:*:* Versions 4.5.3 Running on ·QNAP
- cpe:2.3:o:qnap:quts_hero:h4.5.2:-:*:*:*:*:*:* Versions h4.5.2 Running on ·QNAP
- cpe:2.3:o:qnap:qutscloud:c4.5.4:-:*:*:*:*:*:* Versions c4.5.4 Running on ·QNAP
Remediation
- Fix · CNA myQNAPcloud Link (QNAP Systems Inc.) Fixed in 2.2.21
- Fix · CNA myQNAPcloud Link (QNAP Systems Inc.) Fixed in 2.2.21
- Fix · CNA myQNAPcloud Link (QNAP Systems Inc.) Fixed in 2.2.21
Timeline
- 2026-10-02 Threatist record created from CVE-2021-28815
- 2026-10-03 Alias added: GHSA-x3wj-q2gh-27vc
References
More QNAP Myqnapcloud Link vulnerabilities
- TI-2024-21638 Missing authentication in QNAP myQNAPcloud Link CVSS 3.1CRITICAL 9.9
Sources
- CVE-2021-28815 · CVE Program
- CVE-2021-28815 · NVD
- FIRST EPSS
- GHSA-x3wj-q2gh-27vc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences