by Kastro
Paper/Archive/CVE-2021-32521

CVE-2021-32521

QSAN Storage Manager — QSAN Storage Manager, XEVO, SANOS - Use of Hard-coded Password

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.8.538 × 2010.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Use of MAC address as an authenticated password in QSAN Storage Manager, XEVO, SANOS allows local attackers to escalate privileges. Suggest contacting with QSAN and refer to recommendations in QSAN Document.

Affected

ProductAffectedFixed inSource
Storage Managerunspecified – 3.3.1–CNA
XEVOunspecified – < 1.2.01.2.0CNA
SANOSunspecified – 2.0.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
twcert (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

reftwcert.org.tw/tw/cp-132-4877-7b696-1.html