Vulnerability · Published Jun 24, 2021 · Assigned by qnap

CVE-2021-28800Command Injection Vulnerability in QTS

High 8.1

In plain English

A high-severity OS command injection in QTS from QNAP Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)1.4%top 26.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A command injection vulnerability has been reported to affect QNAP NAS running legacy versions of QTS. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.3.6.1663 Build 20210504; versions prior to 4.3.3.1624 Build 20210416. This issue does not affect: QNAP Systems Inc. QTS 4.5.3. QNAP Systems Inc. QuTS hero h4.5.3. QNAP Systems Inc. QuTScloud c4.5.5.

Affected products (as reported)

Vendor	Product	Versions
QNAP Systems Inc.	QTS	unspecified – before 4.3.6.1663 Build 20210504unspecified – before 4.3.3.1624 Build 20210416
QNAP Systems Inc.	QuTS hero	see references
QNAP Systems Inc.	QuTScloud	see references

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.qnap.com/zh-tw/security-advisory/qsa-21-28 x_refsource_MISC