title: IPTIME NAS2dual improper authentication vulnerability
description: An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important information in the server by exploiting vulnerabilities such as insufficient authentication when accessing the shared folder and changing user’s passwords.
problem types: CWE-287 Improper Authentication
affected:
{
platforms: Windows
product: ipTIME NAS product (NAS1, 2, 3, 4, 1dual, 2dual 4dual)
vendor: EFM Networks Co., Ltd
versions:
lessThan: 1.4.82, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]