by Kastro
Paper/Archive/CVE-2021-34352

CVE-2021-34352

QNAP Systems Inc. QVR — Command Injection Vulnerability in QVR

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 73.9.739 × 2014.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210902 and later

Affected

ProductAffectedFixed inSource
QVRunspecified – < 5.1.5 build 202109025.1.5 build 20210902CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qnap (CNA)7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

refqnap.com/en/security-advisory/qsa-21-38