CVE-2021-26620: IPTIME NAS2dual improper authentication vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-25 · updated 2026-06-17
Weakness: CWE-287

Description

An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important information in the server by exploiting vulnerabilities such as insufficient authentication when accessing the shared folder and changing user’s passwords.

Affected products

Iptime Nas-I Firmware: before 1.4.82 — fixed in 1.4.82
Iptime Nas-Ii Firmware: before 1.4.82 — fixed in 1.4.82
Iptime Nas-Iie Firmware: before 1.4.82 — fixed in 1.4.82
Iptime Nas101 Firmware: before 1.4.82 — fixed in 1.4.82
Iptime Nas1Dual Firmware: before 1.4.82 — fixed in 1.4.82
Iptime Nas2Dual Firmware: before 1.4.82 — fixed in 1.4.82
Iptime Nas3 Firmware: before 1.4.82 — fixed in 1.4.82
Iptime Nas4 Firmware: before 1.4.82 — fixed in 1.4.82
Iptime Nas4Dual Firmware: before 1.4.82 — fixed in 1.4.82

How to fix

Upgrade to a fixed version: Iptime Nas-I Firmware 1.4.82; Iptime Nas-Ii Firmware 1.4.82; Iptime Nas-Iie Firmware 1.4.82; Iptime Nas101 Firmware 1.4.82; Iptime Nas1Dual Firmware 1.4.82; Iptime Nas2Dual Firmware 1.4.82; Iptime Nas3 Firmware 1.4.82; Iptime Nas4 Firmware 1.4.82; Iptime Nas4Dual Firmware 1.4.82. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-26620 or the next vulnerability affects your stack