{"id":"CVE-2021-28805","url":"https://www.cyber-defence.io/tools/cve/CVE-2021-28805","generatedAt":"2026-10-27T21:20:06.968Z","title":"If exploited, this vulnerability allows attackers to read application data.","description":"Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read application data. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.3 build 20210505 on QSW-M2108-2C; versions prior to 1.0.3 build 20210505 on QSW-M2108-2S; versions prior to 1.0.3 build 20210505 on QSW-M2108R-2C; versions prior to 1.0.12 build 20210506 on QSW-M408.","published":"2021-06-11T07:15:07.000Z","lastModified":"2026-06-17T03:46:54.000Z","status":"Modified","sourceIdentifier":"security@qnapsecurity.com.tw","cvss":{"version":"3.1","score":5.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-540","CWE-200"],"affected":["qnap/qss"],"epss":{"score":0.00238,"percentile":0.14683,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.24%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://www.qnap.com/zh-tw/security-advisory/qsa-21-24","tags":["Vendor Advisory"],"source":"security@qnapsecurity.com.tw"},{"url":"https://www.qnap.com/zh-tw/security-advisory/qsa-21-24","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-28805","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}