PT-2021-4408 · Qnap · Qnap Qvr

Published 2021-09-27 · Updated 2021-10-05 · CVE-2021-34348

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QNAP QVR versions prior to 5.1.5 build 20210803

Description A command injection issue affects QNAP devices running QVR, allowing remote attackers to execute arbitrary commands if exploited.

Recommendations For QNAP QVR versions prior to 5.1.5 build 20210803, update to QVR 5.1.5 build 20210803 or later to resolve the issue.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2021-05038

CVE-2021-34348

Affected Products

Qnap Qvr

References · 7

• https://bdu.fstec.ru/vul/2021-05038 · Security Note
• https://qnap.com/en/security-advisory/qsa-21-35 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-34348 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34348 · Security Note
• https://t.me/true_secator/2153 · Telegram Post
• https://t.me/cvenotify/21478 · Telegram Post
• https://t.me/cvenotify/21930 · Telegram Post