Lucene search

[email protected]CVE-2021-38690

HistoryJan 14, 2022 - 1:15 a.m.

CVE-2021-38690

2022-01-1401:15:08

CWE-787

CWE-120

[email protected]

web.nvd.nist.gov

cve-2021-38690

qnap

qvr elite

qvr pro

qvr guard

vulnerability

stack buffer overflow

arbitrary code execution

nvd

security fix

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

66.3%

JSON

A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite, QVR Pro, QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 4.5.4: QVR Guard 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Guard 2.1.3.0 (2021/12/06) and later

Affected configurations

NVD

Node

qnapqvr_eliteRange<2.1.4.0

qnapqvr_guardRange<2.1.3.0

qnapqvr_proRange<2.1.3.0

CPENameOperatorVersion
qnap:qvr_eliteqnap qvr elitelt2.1.4.0
qnap:qvr_guardqnap qvr guardlt2.1.3.0
qnap:qvr_proqnap qvr prolt2.1.3.0

CPE	Name	Operator	Version
qnap:qvr_elite	qnap qvr elite	lt	2.1.4.0
qnap:qvr_guard	qnap qvr guard	lt	2.1.3.0
qnap:qvr_pro	qnap qvr pro	lt	2.1.3.0

CNA Affected

[
  {
    "platforms": [
      "QuTS hero h5.0.0"
    ],
    "product": "QVR Elite",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.1.4.0 (2021/12/06)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QuTS hero h4.5.4"
    ],
    "product": "QVR Elite",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.1.4.0 (2021/12/06)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QTS 5.0.0"
    ],
    "product": "QVR Elite",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.1.4.0 (2021/12/06)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QTS 4.5.4"
    ],
    "product": "QVR Elite",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.1.4.0 (2021/12/06)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QTS 4.5.4"
    ],
    "product": "QVR Pro",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.1.3.0 (2021/12/06)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QTS 5.0.0"
    ],
    "product": "QVR Pro",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.1.3.0 (2021/12/06)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QTS 4.5.4"
    ],
    "product": "QVR Guard",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.1.3.0 (2021/12/06)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "QTS 5.0.0"
    ],
    "product": "QVR Guard",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "2.1.3.0 (2021/12/06)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.qnap.com/en/security-advisory/qsa-21-59

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

66.3%

JSON

Related for CVE-2021-38690

cvelist1 prion1 nvd1