CVE-2021-32530 QSAN XEVO - Command Injection Following via Array function

OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated attackers to execute arbitrary commands via status parameter. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0...

CVE-2021-32530

CVE-2021-32530 describes an OS command injection in the QSAN XEVO product’s Array function, where the status parameter could be used by a remote, unauthenticated attacker to execute arbitrary commands. Reports from multiple sources (NVD entry and CNVD/CNNVD-style disclosures) confirm the vulnerab...

CVE-2021-32529

CVE-2021-32529 affects QSAN XEVO and QSAN SANOS. Multiple connected sources describe a remote, unauthenticated command-injection vulnerability that could allow an attacker to execute arbitrary commands on affected devices. The NVD entry lists a high/critical impact depending on scoring system, wi...

CVE-2021-32529 QSAN XEVO, SANOS - Command Injection -1

Command injection vulnerability in QSAN XEVO, SANOS allows remote unauthenticated attackers to execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32528

CVE-2021-32528 affects QSAN Storage Manager, where an information-disclosure flaw exists in the Access to System Information feature. The underlying issue allows remote attackers to obtain system information without privileges, per multiple sources (NVD/CNVD). Impact is information exposure witho...

CVE-2021-32528 QSAN Storage Manager - Exposure of Sensitive Information to an Unauthorized Actor

Observable behavioral discrepancy vulnerability in QSAN Storage Manager allows remote attackers to obtain the system information without permissions. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32527

Affected software: QSAN Storage Manager (NAS OS) from Quantium Technologies. Vulnerability: Directory traversal (path traversal) in the download function that allows remote unauthenticated attackers to download arbitrary files by injecting a file path. Impact details provided: Exploitation exists...

CVE-2021-32527 QSAN Storage Manager - Path Traversal-2

Path traversal vulnerability in QSAN Storage Manager allows remote unauthenticated attackers to download arbitrary files thru injecting file path in download function. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32526

QSAN Storage Manager is affected by an authorization issue in which permissions are misassigned on critical resource management, allowing authenticated remote attackers to access arbitrary password files. Public sources (CNVD/NVD) indicate impact prior to version 3.3.1 (build 202101041800). The r...

CVE-2021-32526 QSAN Storage Manager - Incorrect Permission Assignment for Critical Resource

Incorrect permission assignment for critical resource vulnerability in QSAN Storage Manager allows authenticated remote attackers to access arbitrary password files. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32525

The CVE-2021-32525 issue affects QSAN Storage Manager (QSAN NAS OS) with hard-coded credentials in firmware up to version 3.3.1 (build 202101041800). The root cause is a hard-coded administrator credential in the debug mode password, allowing remote actors to access the control interface and exec...

CVE-2021-32525 QSAN Storage Manager - Use of Hard-coded Password-2

The same hard-coded password in QSAN Storage Manager's in the firmware allows remote attackers to access the control interface with the administrator’s credential, entering the hard-coded password of the debug mode to execute the restricted system instructions. The referred vulnerability has been...

CVE-2021-32524

CVE-2021-32524 is a reported command-injection vulnerability in QSAN Storage Manager (QSAN NAS OS). The connected documents describe that remote attackers can exploit this flaw to execute arbitrary commands with elevated (privileged) access. The entries do not specify affected versions, exact vul...

CVE-2021-32524 QSAN Storage Manager - Command Injection-3

Command injection vulnerability in QSAN Storage Manager allows remote privileged users to execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32523

CVE-2021-32523 affects QSAN Storage Manager. The vulnerability is an improper authorization issue that allows remote privileged users to bypass access controls and execute arbitrary commands. Affected software is QSAN Storage Manager (QSAN Storage Manager version 3.3.1 and earlier per CNVD/CNNVD ...

CVE-2021-32523 QSAN Storage Manager - Improper Authorization

Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32522 QSAN Storage Manager, XEVO, SANOS - Improper Restriction of Excessive Authentication Attempts

Improper restriction of excessive authentication attempts vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to discover users’ credentials and obtain access via a brute force attack. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32522

CVE-2021-32522 affects QSAN products including Storage Manager, XEVO, and SANOS. The root cause is an improper restriction of excessive authentication attempts (an access control error) that can allow remote attackers to discover user credentials and gain access via brute-force style attempts. Pu...

CVE-2021-32521 QSAN Storage Manager, XEVO, SANOS - Use of Hard-coded Password

Use of MAC address as an authenticated password in QSAN Storage Manager, XEVO, SANOS allows local attackers to escalate privileges. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32521

CVE-2021-32521 affects QSAN Storage Manager, XEVO and SANOS. Vulnerability arises from using MAC addresses as authenticated passwords, enabling local privilege escalation by a non-remote attacker. Documented impact is privilege escalation with trusted access to QSAN products; exploitation is loca...