CVE-2021-38692
Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite, QVR Pro, QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 4.5.4: QVR Guard 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Guard 2.1.3.0 (2021/12/06) and later
Se ha informado de una vulnerabilidad de desbordamiento del búfer de la pila que afecta al dispositivo de QNAP que ejecuta QVR Elite, QVR Pro, QVR Guard. Si es explotado, esta vulnerabilidad permite a atacantes ejecutar código arbitrario. Ya hemos corregido esta vulnerabilidad en las siguientes versiones de QVR Elite, QVR Pro, QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (06/12/2021) y posteriores QuTS hero h4.5.4: QVR Elite 2.1.4.0 (06/12/2021) y posteriores QTS 5.0.0: QVR Elite 2.1.4.0 (06/12/2021) y posteriores QTS 4.5.4: QVR Elite 2.1.4.0 (06/12/2021) y posteriores QTS 4.5.4: QVR Pro 2.1.3.0 (06/12/2021) y posteriores QTS 5.0.0: QVR Pro 2.1.3.0 (06/12/2021) y posteriores QTS 4.5.4: QVR Guard 2.1.3.0 (06/12/2021) y posteriores QTS 5.0.0: QVR Guard 2.1.3.0 (06/12/2021) y posteriores
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-08-13 CVE Reserved
- 2022-01-14 CVE Published
- 2024-09-16 CVE Updated
- 2024-09-29 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
- CWE-787: Out-of-bounds Write
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://www.qnap.com/en/security-advisory/qsa-21-59 | 2022-01-22 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Qnap Search vendor "Qnap" | Qvr Elite Search vendor "Qnap" for product "Qvr Elite" | < 2.1.4.0 Search vendor "Qnap" for product "Qvr Elite" and version " < 2.1.4.0" | - |
Affected
| ||||||
Qnap Search vendor "Qnap" | Qvr Guard Search vendor "Qnap" for product "Qvr Guard" | < 2.1.3.0 Search vendor "Qnap" for product "Qvr Guard" and version " < 2.1.3.0" | - |
Affected
| ||||||
Qnap Search vendor "Qnap" | Qvr Pro Search vendor "Qnap" for product "Qvr Pro" | < 2.1.3.0 Search vendor "Qnap" for product "Qvr Pro" and version " < 2.1.3.0" | - |
Affected
|