CVE-2021-28815: Insecure Storage of Sensitive Information in myQNAPcloud Link

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-16 · updated 2026-06-17
Weakness: CWE-922

Description

Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism. This issue affects: QNAP Systems Inc. myQNAPcloud Link versions prior to 2.2.21 on QTS 4.5.3; versions prior to 2.2.21 on QuTS hero h4.5.2; versions prior to 2.2.21 on QuTScloud c4.5.4.

Affected products

QNAP Systems Inc. myQNAPcloud Link: before 2.2.21 — fixed in 2.2.21

How to fix

Upgrade to a fixed version: QNAP Systems Inc. myQNAPcloud Link 2.2.21. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-28815 or the next vulnerability affects your stack