CVE-2021-28797: Stack Buffer Overflow in Surveillance Station
First published: Wed Apr 14 2021(Updated: )
A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3 (and later) for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS) Surveillance Station 5.1.5.3.3 (and later) for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS)
Credit: security@qnapsecurity.com.tw
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Qnap Surveillance Station | <5.1.5.3.3 | |
| Qnap Surveillance Station | >=5.1.5.4.0<5.1.5.4.3 | |
| QNAP NAS |
Remedy
QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3 (and later) for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS) Surveillance Station 5.1.5.3.3 (and later) for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS)
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-28797?
CVE-2021-28797 is a stack-based buffer overflow vulnerability that affects QNAP NAS devices running Surveillance Station.
What is the severity of CVE-2021-28797?
The severity of CVE-2021-28797 is critical with a CVSS score of 9.8.
How does CVE-2021-28797 affect QNAP NAS devices?
CVE-2021-28797 allows attackers to execute arbitrary code on QNAP NAS devices running Surveillance Station.
Has QNAP fixed CVE-2021-28797?
Yes, QNAP has already fixed CVE-2021-28797 in Surveillance Station version 5.1.5.4.3.
Where can I find more information about CVE-2021-28797?
You can find more information about CVE-2021-28797 on the QNAP security advisory page at [https://www.qnap.com/en/security-advisory/qsa-21-07](https://www.qnap.com/en/security-advisory/qsa-21-07).
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/title
- agent/severity
- agent/author
- agent/remedy
- agent/softwarecombine
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/qnap
- canonical/qnap surveillance station
- version/qnap surveillance station/5.1.5.4.0
- canonical/qnap nas