CVE-2021-28812: Command Injection Vulnerability in Video Station

Q: What is CVE-2021-28812?

CVE-2021-28812 is a command injection vulnerability that affects certain versions of QNAP Video Station.

Q: How can CVE-2021-28812 be exploited?

CVE-2021-28812 can be exploited by remote attackers to execute arbitrary commands.

Q: Which versions of Video Station are affected by CVE-2021-28812?

Versions of Video Station prior to 5.5.4 on QTS 4.5.2 are affected by CVE-2021-28812.

Q: How severe is CVE-2021-28812?

CVE-2021-28812 has a severity score of 8.8 (High).

Q: How can I fix CVE-2021-28812?

To fix CVE-2021-28812, it is recommended to update Video Station to version 5.5.4 or later on QTS 4.5.2.

Published Jun 3, 2021

Updated

A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Video Station versions prior to 5.5.4 on QTS 4.5.2; versions prior to 5.5.4 on QuTS hero h4.5.2; versions prior to 5.5.4 on QuTScloud c4.5.4. This issue does not affect: QNAP Systems Inc. Video Station on QTS 4.3.6; on QTS 4.3.3.

Affected Software

4 affected components

QNAP Video Station<5.5.4

QNAP QTS=4.5.2

QNAP QuTS hero=h4.5.2

QNAP QuTScloud=c4.5.4

Remediation

Information

QNAP have already fixed the issue in the following versions: QTS 4.5.2: Video Station 5.5.4 and later QuTS hero h4.5.2: Video Station 5.5.4 and later QuTScloud c4.5.4: Video Station 5.5.4 and later

Event History

Jun 3, 2021

CVE Published

via MITRE·02:45 AM

Data Sourced

via MITRE·02:45 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2021-28812?

CVE-2021-28812 is a command injection vulnerability that affects certain versions of QNAP Video Station.

How can CVE-2021-28812 be exploited?