CVE-2020-2499 - Hard-coded Password Vulnerability in QES

Back Back to CVE browser

HIGH

Hard-coded Password Vulnerability in QES

Published Dec 24, 2020

7.2

HIGH

CVSS 3.1

EPSS 1.38%

Description

A hard-coded password vulnerability has been reported to affect earlier versions of QES. If exploited, this vulnerability could allow attackers to log in with a hard-coded password. QNAP has already fixed the issue in QES 2.1.1 Build 20200515 and later.

Affected products

Vendor QNAP Systems Inc. Product QES Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <2.1.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

QNAP Systems Inc.

QES

n/a

Version	Status	Constraints
unspecified	affected	<2.1.1

Remediation

Vendor solution

QNAP has already fixed the issue in QES 2.1.1 Build 20200515 and later.

Weaknesses (3)

CWE-259

CWE-522

Insufficiently Protected Credentials

CWE-798

Hard-coded Credentials

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-22292
Advisory
https://www.qnap.com/zh-tw/security-advisory/qsa-20-19
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-22292		Advisory
https://www.qnap.com/zh-tw/security-advisory/qsa-20-19		x_refsource_MISCVendor Advisory