CVE-2021-28804: Command Injection Vulnerabilities in QTS and QuTS hero
A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.1.1540 build 20210107. QNAP Systems Inc. QuTS hero versions prior to h4.5.1.1582 build 20210217.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2021-28804?
CVE-2021-28804 is a command injection vulnerability that affects QTS and QuTS hero.
How does CVE-2021-28804 affect QNAP systems?
If exploited, CVE-2021-28804 allows attackers to execute arbitrary commands in a compromised QNAP application.
Which versions of QTS are affected by CVE-2021-28804?
Versions of QTS prior to 4.5.1.1540 build 20210107 are affected by CVE-2021-28804.
Which versions of QuTS hero are affected by CVE-2021-28804?
Versions of QuTS hero up to h4.5.1.1582 are affected by CVE-2021-28804.
How severe is CVE-2021-28804?
CVE-2021-28804 has a severity rating of 9.8, indicating it is critical.
How can I fix CVE-2021-28804?
To fix CVE-2021-28804, it is recommended to update QTS to version 4.5.1.1540 build 20210107 or later, and QuTS hero to version h4.5.1.1582 or later.
Where can I find more information about CVE-2021-28804?
More information about CVE-2021-28804 can be found at the following URL: https://www.qnap.com/zh-tw/security-advisory/qsa-21-29