CVE-2021-38679

MEDIUM

QNAP Kazoo Server < 4.11.22 - Improper Authentication

Title source: llm
STIX 2.1

Description

An improper authentication vulnerability has been reported to affect QNAP NAS running Kazoo Server. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Kazoo Server: Kazoo Server 4.11.22 and later

References (1)

Core 1
Core References
Vendor Advisory x_refsource_misc
https://www.qnap.com/en/security-advisory/qsa-22-01

Scores

CVSS v3 6.5
EPSS 0.0020
EPSS Percentile 41.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Details

CWE
CWE-287
Status published
Products (1)
qnap/kazoo_server < 4.11.22
Published Feb 11, 2022
Tracked Since Feb 18, 2026