PT-2021-17924 · Qnap Systems · Qts

Published 2021-06-24 · Updated 2021-06-30 · CVE-2021-28800

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. QTS versions prior to 4.3.6.1663 Build 20210504 QNAP Systems Inc. QTS versions prior to 4.3.3.1624 Build 20210416

Description: A command injection issue has been reported to affect QNAP NAS running legacy versions of QTS. If exploited, this issue allows attackers to execute arbitrary commands in a compromised application.

Recommendations: For QNAP Systems Inc. QTS versions prior to 4.3.6.1663 Build 20210504, update to version 4.3.6.1663 Build 20210504 or later. For QNAP Systems Inc. QTS versions prior to 4.3.3.1624 Build 20210416, update to version 4.3.3.1624 Build 20210416 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-28800

Affected Products

Qts

References · 4

• https://qnap.com/zh-tw/security-advisory/qsa-21-28 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-28800 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28800 · Security Note
• https://t.me/cvenotify/16909 · Telegram Post