CVE-2021-28812

🗓️ 03 Jun 2021 02:45:14Reported by qnapType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 84 Views

A command injection vulnerability allows remote attackers to execute arbitrary commands in QNAP Video Station versions prior to 5.5.4 on QTS 4.5.2, QuTS hero h4.5.2, and QuTScloud c4.5.4

Reporter	Title	Published	Views	Family All 8
CNNVD	QNAP Systems Video Station 命令注入漏洞	3 Jun 202100:00	–	cnnvd
Cvelist	CVE-2021-28812 Command Injection Vulnerability in Video Station	3 Jun 202102:45	–	cvelist
EUVD	EUVD-2021-15468	7 Oct 202500:30	–	euvd
NVD	CVE-2021-28812	3 Jun 202103:15	–	nvd
OpenVAS	QNAP QTS Video Station Command Injection Vulnerability (QSA-21-21)	7 Jun 202100:00	–	openvas
OSV	CVE-2021-28812	3 Jun 202103:15	–	osv
Prion	Command injection	3 Jun 202103:15	–	prion
Positive Technologies	PT-2021-17934 · Qnap Systems · Quts Hero +3	3 Jun 202100:00	–	ptsecurity

NVD

Node

qnap video_stationRange<5.5.4

AND

qnap qtsMatch4.5.2

Node

qnap video_stationRange<5.5.4

AND

qnap quts_heroMatchh4.5.2

Node

qnap video_stationRange<5.5.4

AND

qnap qutscloudMatchc4.5.4

[
  {
    "platforms": [
      "QTS 4.5.2"
    ],
    "product": "Video Station",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "5.5.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QuTS hero h4.5.2"
    ],
    "product": "Video Station",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "5.5.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QuTScloud c4.5.4"
    ],
    "product": "Video Station",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "5.5.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QTS 4.3.6"
    ],
    "product": "Video Station",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "status": "unaffected",
        "version": "5.3.x"
      }
    ]
  },
  {
    "platforms": [
      "QTS 4.3.3"
    ],
    "product": "Video Station",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "status": "unaffected",
        "version": "5.1.x"
      }
    ]
  }
]

Source	Link
qnap	www.qnap.com/zh-tw/security-advisory/qsa-21-21

21 Nov 2024 06:00Current

9.1High risk

Vulners AI Score9.1

CVSS 26.5

CVSS 3.18.8

EPSS0.02304

cve-2021-28812 command injection vulnerability video station qnap systems inc.remote attackers arbitrary commands qts 4.5.2 quts hero qutscloud