CVE-2020-2499: Hard-coded Password Vulnerability in QES

Description

A hard-coded password vulnerability has been reported to affect earlier versions of QES. If exploited, this vulnerability could allow attackers to log in with a hard-coded password. QNAP has already fixed the issue in QES 2.1.1 Build 20200515 and later.

Scores

CVSS scores of CVE-2020-2499, by who scored it
Scored by	CVSS	Score	Vector
qnapCNA (assigner)	3.1	Medium6.3	CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N
NVDNVD · Modified	3.1	High7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 1.4% · top 28% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.

Weakness

CWE-259 Use of Hard-coded Password (opens in a new tab)All about CWE-259 and its CVEs
CWE-798 Use of Hard-coded Credentials (opens in a new tab)All about CWE-798 and its CVEs
CWE-522 Insufficiently Protected Credentials (opens in a new tab)All about CWE-522 and its CVEs

Affected products

QNAP Systems Inc. · QES
- affected unspecified – < 2.1.1

What to do

Solution: QNAP has already fixed the issue in QES 2.1.1 Build 20200515 and later.

References (1)

https://www.qnap.com/zh-tw/security-advisory/qsa-20-19 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2020-2499](https://trackcve.app/badge/CVE-2020-2499.svg)](https://trackcve.app/cve/CVE-2020-2499)

Record last updated 17 Sept 2024, 03:18 UTC.