PT-2021-4405 · Qnap · Qnap Qvr

Published 2021-09-27 · Updated 2021-10-05 · CVE-2021-34351

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QNAP QVR versions prior to 5.1.5 build 20210803

Description A command injection issue has been reported, affecting QNAP devices running QVR. This could allow remote attackers to run arbitrary commands if exploited. The issue is related to the lack of neutralization of special elements used in the OS command.

Recommendations For QNAP QVR versions prior to 5.1.5 build 20210803, update to QVR 5.1.5 build 20210803 or later to resolve the issue. As a temporary workaround, consider restricting access to the QVR system to minimize the risk of exploitation.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2021-05035

CVE-2021-34351

Affected Products

Qnap Qvr

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-34351 · Security Note
• https://qnap.com/en/security-advisory/qsa-21-35 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-34351 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05035 · Security Note
• https://t.me/cvenotify/21932 · Telegram Post
• https://t.me/true_secator/2153 · Telegram Post
• https://t.me/cvenotify/21476 · Telegram Post