CVE-2021-26620: Iptime NAS-I Firmware

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important information in the server by exploiting vulnerabilities such as insufficient authentication when accessing the shared folder and changing user’s passwords.

Affected products

• Iptime NAS-I Firmware: before 1.4.82 (fixed in 1.4.82)
• Iptime NAS-Ii Firmware: before 1.4.82 (fixed in 1.4.82)
• Iptime NAS-Iie Firmware: before 1.4.82 (fixed in 1.4.82)
• Iptime NAS101 Firmware: before 1.4.82 (fixed in 1.4.82)
• Iptime NAS1DUAL Firmware: before 1.4.82 (fixed in 1.4.82)
• Iptime NAS2DUAL Firmware: before 1.4.82 (fixed in 1.4.82)
• Iptime NAS3 Firmware: before 1.4.82 (fixed in 1.4.82)
• Iptime NAS4 Firmware: before 1.4.82 (fixed in 1.4.82)
• Iptime NAS4DUAL Firmware: before 1.4.82 (fixed in 1.4.82)

Published 2022-03-25. Last modified 2026-06-17.