Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2021-28800

Command Injection Vulnerability in QTS

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
qnap

Description

A command injection vulnerability has been reported to affect QNAP NAS running legacy versions of QTS. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.3.6.1663 Build 20210504; versions prior to 4.3.3.1624 Build 20210416. This issue does not affect: QNAP Systems Inc. QTS 4.5.3. QNAP Systems Inc. QuTS hero h4.5.3. QNAP Systems Inc. QuTScloud c4.5.5.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

QNAP Systems Inc. QTS

  • unspecified to < 4.3.6.1663 Build 20210504affected
  • unspecified to < 4.3.3.1624 Build 20210416affected
  • 4.5.3unaffected

QNAP Systems Inc. QuTS hero

  • h4.5.3unaffected

QNAP Systems Inc. QuTScloud

  • c4.5.5unaffected

References