CVE-2021-28800: Command Injection Vulnerability in QTS

Q: What is CVE-2021-28800?

CVE-2021-28800 is a command injection vulnerability that affects QNAP NAS devices running legacy versions of QTS.

Q: What is the severity of CVE-2021-28800?

The severity of CVE-2021-28800 is critical with a severity value of 9.8.

Q: What software is affected by CVE-2021-28800?

QNAP NAS devices running QTS versions prior to 4.3.6.1663 Build 20210504 are affected by CVE-2021-28800.

Q: How can CVE-2021-28800 be exploited?

CVE-2021-28800 can be exploited by attackers to execute arbitrary commands in a compromised application.

Q: How can I fix CVE-2021-28800?

To fix CVE-2021-28800, update QTS to version 4.3.6.1663 Build 20210504 or later.

Published Jun 24, 2021

Updated

A command injection vulnerability has been reported to affect QNAP NAS running legacy versions of QTS. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.3.6.1663 Build 20210504; versions prior to 4.3.3.1624 Build 20210416. This issue does not affect: QNAP Systems Inc. QTS 4.5.3. QNAP Systems Inc. QuTS hero h4.5.3. QNAP Systems Inc. QuTScloud c4.5.5.

Affected Software

2 affected components

QNAP QTS<4.3.3.1624

QNAP QTS>=4.3.4<4.3.6.1663

Remediation

Information

QNAP have already fixed this vulnerability in the following versions: QTS 4.3.6.1663 Build 20210504 and later QTS 4.3.3.1624 Build 20210416 and later

Event History

Jun 24, 2021

CVE Published

via MITRE·06:20 AM

Data Sourced

via MITRE·06:20 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2021-28800?

CVE-2021-28800 is a command injection vulnerability that affects QNAP NAS devices running legacy versions of QTS.

What is the severity of CVE-2021-28800?