Log in Start free

Vulnerability · Published Oct 22, 2021 · Assigned by qnap

CVE-2021-34362Command Injection Vulnerability in Media Streaming Add-on

High 8.7

In plain English

A high-severity OS command injection in Media Streaming add-on from QNAP Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).

Severity (CVSS 3.1)8.7High
Exploit odds (30 days)1.3%top 30.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A command injection vulnerability has been reported to affect QNAP device running Media Streaming add-on. If exploited, this vulnerability allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of Media Streaming add-on: QTS 5.0.0: Media Streaming add-on 500.0.0.3 ( 2021/08/20 ) and later QTS 4.5.4: Media Streaming add-on 500.0.0.3 ( 2021/08/20 ) and later QTS 4.3.6: Media Streaming add-on 430.1.8.12 ( 2021/08/20 ) and later QTS 4.3.3: Media Streaming add-on 430.1.8.12 ( 2021/09/29 ) and later QuTS-Hero 5.0.0: Media Streaming add-on 500.0.0.3 ( 2021/08/20 ) and later

Affected products (as reported)

VendorProductVersions
QNAP Systems Inc. Media Streaming add-on unspecified – before 500.0.0.3 ( 2021/08/20 )
QNAP Systems Inc. Media Streaming add-on unspecified – before 500.0.0.3 ( 2021/08/20 )
QNAP Systems Inc. Media Streaming add-on unspecified – before 500.0.0.3 ( 2021/08/20 )
QNAP Systems Inc. Media Streaming add-on unspecified – before 430.1.8.12 ( 2021/08/20 )
QNAP Systems Inc. Media Streaming add-on unspecified – before 430.1.8.12 ( 2021/09/29 )

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

References