CVE-2021-28801

An out-of-bounds read vulnerability has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read sensitive information on the system. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.2 build 20210122 on QSW-M2108-2C; versions prior to 1.0.2 build 20210122 on QSW-M2108-2S; versions prior to 1.0.2 build 20210122 on QSW-M2108R-2C.

• CWE-125

• https://www.qnap.com/zh-tw/security-advisory/qsa-21-23Vendor Advisory
• https://www.qnap.com/zh-tw/security-advisory/qsa-21-23Vendor Advisory

Published

Jun 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-28794The unofficial ShellCheck extension before 0.13.4 for Visual…9.8
• CVE-2021-28796Increments Qiita::Markdown before 0.33.0 allows XSS in trans…6.1
• CVE-2021-28797A stack-based buffer overflow vulnerability has been reporte…9.8
• CVE-2021-28798A relative path traversal vulnerability has been reported to…7.5
• CVE-2021-28799An improper authorization vulnerability has been reported to…9.8
• CVE-2021-28800A command injection vulnerability has been reported to affec…9.8
• CVE-2021-28802A command injection vulnerabilities have been reported to af…9.8
• CVE-2021-28803This issue affects: QNAP Systems Inc. Q'center versions prio…5.4
• CVE-2021-28804A command injection vulnerabilities have been reported to af…9.8
• CVE-2021-28805Inclusion of sensitive information in the source code has be…5.5
• CVE-2021-28806A DOM-based XSS vulnerability has been reported to affect QN…5.4
• CVE-2021-28807A post-authentication reflected XSS vulnerability has been r…5.4