Lucene search

QnapCVE-2021-34346

HistorySep 10, 2021 - 4:15 a.m.

CVE-2021-34346

2021-09-1004:15:18

CWE-787

qnap

web.nvd.nist.gov

cve-2021-34346

stack buffer overflow

qnap

nvr storage expansion

security vulnerability

arbitrary code execution

cve

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.003

Percentile

72.0%

JSON

A stack buffer overflow vulnerability has been reported to affect QNAP device running NVR Storage Expansion. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of NVR Storage Expansion: NVR Storage Expansion 1.0.6 ( 2021/08/03 ) and later

Affected configurations

Nvd

Node

qnapnvr_storage_expansion_firmwareRange<1.0.6

AND

qnapnvr_storage_expansionMatch-

VendorProductVersionCPE
qnapnvr_storage_expansion_firmware*cpe:2.3:o:qnap:nvr_storage_expansion_firmware:*:*:*:*:*:*:*:*
qnapnvr_storage_expansion-cpe:2.3:h:qnap:nvr_storage_expansion:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qnap	nvr_storage_expansion_firmware	*	cpe:2.3:o:qnap:nvr_storage_expansion_firmware::::::::
qnap	nvr_storage_expansion	-	cpe:2.3:h:qnap:nvr_storage_expansion:-:::::::*

CNA Affected

[
  {
    "product": "NVR Storage Expansion",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "1.0.6 ( 2021/08/03 )",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.qnap.com/en/security-advisory/qsa-21-36

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.003

Percentile

72.0%

JSON

Related for CVE-2021-34346