by Kastro
Paper/Archive/CVE-2021-34351

CVE-2021-34351

QNAP Systems Inc. QVR — Command Injection Vulnerability in QVR

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 73.8.738 × 2014.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later

Affected

ProductAffectedFixed inSource
QVRunspecified – < 5.1.5 build 202108035.1.5 build 20210803CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qnap (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refqnap.com/en/security-advisory/qsa-21-35