PT-2021-17934 · Qnap Systems · Quts Hero+3

Thomas Fady · Published 2021-06-03 · Updated 2022-10-18 · CVE-2021-28812

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. Video Station versions prior to 5.5.4 on QTS 4.5.2 QNAP Systems Inc. Video Station versions prior to 5.5.4 on QuTS hero h4.5.2 QNAP Systems Inc. Video Station versions prior to 5.5.4 on QuTScloud c4.5.4

Description: A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to execute arbitrary commands.

Recommendations: For versions prior to 5.5.4 on QTS 4.5.2, update to version 5.5.4 or later. For versions prior to 5.5.4 on QuTS hero h4.5.2, update to version 5.5.4 or later. For versions prior to 5.5.4 on QuTScloud c4.5.4, update to version 5.5.4 or later.

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-1286

CWE-78

Related Identifiers

CVE-2021-28812

Affected Products

Qts

Quts Hero

Qutscloud

Video Station

References · 5

• https://qnap.com/zh-tw/security-advisory/qsa-21-21 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28812 · Security Note
• https://osv.dev/vulnerability/CVE-2021-28812 · Vendor Advisory
• https://t.me/cvenotify/15457 · Telegram Post
• https://t.me/cvenotify/16224 · Telegram Post