Lucene search

QnapCVE-2021-38691

HistoryJan 14, 2022 - 1:15 a.m.

CVE-2021-38691

2022-01-1401:15:08

CWE-787

CWE-120

qnap

web.nvd.nist.gov

cve-2021-38691

qnap

qvr elite

qvr pro

qvr guard

security vulnerability

stack buffer overflow

arbitrary code execution

nvd

patch

update

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.003

Percentile

71.1%

JSON

A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite, QVR Pro, QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 4.5.4: QVR Guard 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Guard 2.1.3.0 (2021/12/06) and later

Affected configurations

Nvd

Node

qnapqvr_eliteRange<2.1.4.0

qnapqvr_guardRange<2.1.3.0

qnapqvr_proRange<2.1.3.0

VendorProductVersionCPE
qnapqvr_elite*cpe:2.3:a:qnap:qvr_elite:*:*:*:*:*:*:*:*
qnapqvr_guard*cpe:2.3:a:qnap:qvr_guard:*:*:*:*:*:*:*:*
qnapqvr_pro*cpe:2.3:a:qnap:qvr_pro:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qnap	qvr_elite	*	cpe:2.3:a:qnap:qvr_elite::::::::
qnap	qvr_guard	*	cpe:2.3:a:qnap:qvr_guard::::::::
qnap	qvr_pro	*	cpe:2.3:a:qnap:qvr_pro::::::::

CNA Affected

[
  {
    "platforms": [
      "QuTS hero h5.0.0"
    ],
    "product": "QVR Elite",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.1.4.0 (2021/12/06)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QuTS hero h4.5.4"
    ],
    "product": "QVR Elite",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.1.4.0 (2021/12/06)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QTS 5.0.0"
    ],
    "product": "QVR Elite",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.1.4.0 (2021/12/06)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QTS 4.5.4"
    ],
    "product": "QVR Elite",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.1.4.0 (2021/12/06)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QTS 4.5.4"
    ],
    "product": "QVR Pro",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.1.3.0 (2021/12/06)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QTS 5.0.0"
    ],
    "product": "QVR Pro",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.1.3.0 (2021/12/06)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QTS 4.5.4"
    ],
    "product": "QVR Guard",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.1.3.0 (2021/12/06)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QTS 5.0.0"
    ],
    "product": "QVR Guard",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.1.3.0 (2021/12/06)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.qnap.com/en/security-advisory/qsa-21-59

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.003

Percentile

71.1%

JSON

Related for CVE-2021-38691