CVE-2021-34348 – Command Injection Vulnerability in QVR

https://notcve.org/view.php?id=CVE-2021-34348

A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later Se ha informado de una vulnerabilidad de inyección de comandos que afecta al dispositivo de QNAP que ejecuta QVR. Si es explotado, esta vulnerabilidad podría permitir a atacantes remotos ejecutar comandos arbitrarios. Ya hemos corregido esta vulnerabilidad en las siguientes versiones de QVR: QVR 5.1.5 build 20210803 y posteriores • https://www.qnap.com/en/security-advisory/qsa-21-35 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •