CVE-2021-34348 | THREATINT

Description

A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later

Reserved 2021-06-08 | Published 2021-09-27 | Updated 2024-09-16 | Assigner qnap

CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-78

Product status

Any version before 5.1.5 build 20210803

affected

Credits

360 的安全研究员侯留洋（houliuyang@360.cn）和叶根深（yegenshen@360.cn）

References

www.qnap.com/en/security-advisory/qsa-21-35

cve.org (CVE-2021-34348)

nvd.nist.gov (CVE-2021-34348)

Download JSON

Support options

Helpdesk Chat, Email, Knowledgebase

Subscribe to our newsletter to learn more about our work.