PT-2021-4404 · Qnap · Qnap Qvr

Published 2021-09-27 · Updated 2021-10-05 · CVE-2021-34349

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QNAP QVR versions prior to 5.1.5 build 20210803

Description A command injection issue has been reported, affecting QNAP devices running QVR. This issue could allow remote attackers to run arbitrary commands if exploited. The vulnerability is related to the lack of neutralization of special elements used in the operating system command.

Recommendations For QNAP QVR versions prior to 5.1.5 build 20210803, update to QVR 5.1.5 build 20210803 or later to resolve the issue. As a temporary workaround, consider restricting access to the QVR system to minimize the risk of exploitation.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2021-05034

CVE-2021-34349

Affected Products

Qnap Qvr

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-34349 · Security Note
• https://qnap.com/en/security-advisory/qsa-21-35 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05034 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34349 · Vendor Advisory
• https://t.me/true_secator/2153 · Telegram Post
• https://t.me/cvenotify/21477 · Telegram Post
• https://t.me/cvenotify/21933 · Telegram Post