« Volver al listado

CVE-2020-2499

Estado: ModificadaAlta (7.2)—

A hard-coded password vulnerability has been reported to affect earlier versions of QES. If exploited, this vulnerability could allow attackers to log in with a hard-coded password. QNAP has already fixed the issue in QES 2.1.1 Build 20200515 and later.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Qnap — QES

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-2499",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@qnapsecurity.com.tw",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 1.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@qnapsecurity.com.tw",
      "affectedData": [
        {
          "vendor": "QNAP Systems Inc.",
          "product": "QES",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2.1.1",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "build 20200515"
          ]
        }
      ]
    }
  ],
  "published": "2020-12-24T02:15:12.423",
  "references": [
    {
      "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-19",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@qnapsecurity.com.tw"
    },
    {
      "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-20-19",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@qnapsecurity.com.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-259"
        },
        {
          "lang": "en",
          "value": "CWE-522"
        },
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A hard-coded password vulnerability has been reported to affect earlier versions of QES. If exploited, this vulnerability could allow attackers to log in with a hard-coded password. QNAP has already fixed the issue in QES 2.1.1 Build 20200515 and later."
    },
    {
      "lang": "es",
      "value": "Se ha reportado de una vulnerabilidad de contraseña embebida que afecta a versiones anteriores de QES. Si es explotada, esta vulnerabilidad podría permitir a atacantes iniciar sesión con una contraseña embebida. QNAP ya ha corregido el problema en QES versión 2.1.1 Build 20200515 y posteriores"
    }
  ],
  "lastModified": "2026-06-17T03:12:14.193",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qnap:qes:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5DBF31A-5D26-4C7D-8E69-31061FC16C6D",
              "versionEndExcluding": "2.1.1"
            },
            {
              "criteria": "cpe:2.3:a:qnap:qes:2.1.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B075440F-4DEA-494D-AE27-1182CA4889D1"
            },
            {
              "criteria": "cpe:2.3:a:qnap:qes:2.1.1:build_20200211:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67632014-C383-490C-B048-4DFE88AD3F30"
            },
            {
              "criteria": "cpe:2.3:a:qnap:qes:2.1.1:build_20200303:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF83A348-E7B1-4008-8313-9F28B9A9B020"
            },
            {
              "criteria": "cpe:2.3:a:qnap:qes:2.1.1:build_20200319:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AAF45709-BE55-45A4-8DD1-0D3E417D8382"
            },
            {
              "criteria": "cpe:2.3:a:qnap:qes:2.1.1:build_20200424:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C956E79-D019-4AE3-BB65-9A70282CD780"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@qnapsecurity.com.tw"
}