PT-2021-19744 · Qsan · Qsan Sanos+2

Published 2021-07-07 · Updated 2021-09-20 · CVE-2021-32519

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager versions prior to 3.3.2 QSAN XEVO versions prior to 2.1.0 QSAN SANOS versions prior to 2.1.0

Description: The issue allows remote attackers to recover the plain-text password by brute-forcing the MD5 hash due to the use of a password hash with insufficient computational effort.

Recommendations: For QSAN Storage Manager versions prior to 3.3.2, update to version 3.3.2 or later. For QSAN XEVO versions prior to 2.1.0, update to version 2.1.0 or later. For QSAN SANOS versions prior to 2.1.0, update to version 2.1.0 or later.

Fix

Weakness Enumeration

CWE-916

Related Identifiers

CVE-2021-32519

Affected Products

Qsan Sanos

Qsan Storage Manager

Qsan Xevo

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-32519 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32519 · Vendor Advisory
• https://t.me/cvenotify/18004 · Telegram Post
• https://twcert.org.tw/tw/cp-132-4875-692f0-1.html · Note