CVE-2021-28802: Command Injection Vulnerabilities in QTS and QuTS hero
A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.1.1540 build 20210107. QNAP Systems Inc. QuTS hero versions prior to h4.5.1.1582 build 20210217.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-28802.
What is the severity of CVE-2021-28802?
The severity of CVE-2021-28802 is critical.
Which software versions are affected by CVE-2021-28802?
QTS versions prior to 4.5.1.1540 build 20210107 and Quts Hero versions prior to h4.5.1.1582 are affected by CVE-2021-28802.
What is the impact of CVE-2021-28802?
If exploited, CVE-2021-28802 allows attackers to execute arbitrary commands in a compromised application.
How can I fix CVE-2021-28802?
To fix CVE-2021-28802, update to QTS version 4.5.1.1540 build 20210107 (or later) or update to Quts Hero version h4.5.1.1582 (or later).