Vulnerability · Published Jan 16, 2026 · Assigned by VulnCheck
CVE-2021-47816Thecus N4800Eco Nas Server Control Panel - Command Injection
High 8.8
In plain English
A high-severity OS command injection in Thecus N4800Eco Nas Server Control Panel from Thecus. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.8%top 21.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Thecus N4800Eco NAS Server Control Panel contains a command injection vulnerability that allows authenticated attackers to execute arbitrary system commands through user management endpoints. Attackers can inject commands via username and batch user creation parameters to execute shell commands with administrative privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Thecus | Thecus N4800Eco Nas Server Control Panel | N4800Eco |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-49926 exploit
- Thecus Official Vendor Homepage product
- Thecus N4800Eco Product Page product
- Researcher Blog technical-description, exploit
- VulnCheck Advisory: Thecus N4800Eco Nas Server Control Panel - Command Injection third-party-advisory