CVE-2021-32526 QSAN Storage Manager - Incorrect Permission Assignment for Critical Resource

Incorrect permission assignment for critical resource vulnerability in QSAN Storage Manager allows authenticated remote attackers to access arbitrary password files. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32525

The CVE-2021-32525 issue affects QSAN Storage Manager (QSAN NAS OS) with hard-coded credentials in firmware up to version 3.3.1 (build 202101041800). The root cause is a hard-coded administrator credential in the debug mode password, allowing remote actors to access the control interface and exec...

CVE-2021-32525 QSAN Storage Manager - Use of Hard-coded Password-2

The same hard-coded password in QSAN Storage Manager's in the firmware allows remote attackers to access the control interface with the administrator’s credential, entering the hard-coded password of the debug mode to execute the restricted system instructions. The referred vulnerability has been...

CVE-2021-32524

CVE-2021-32524 is a reported command-injection vulnerability in QSAN Storage Manager (QSAN NAS OS). The connected documents describe that remote attackers can exploit this flaw to execute arbitrary commands with elevated (privileged) access. The entries do not specify affected versions, exact vul...

CVE-2021-32523

CVE-2021-32523 affects QSAN Storage Manager. The vulnerability is an improper authorization issue that allows remote privileged users to bypass access controls and execute arbitrary commands. Affected software is QSAN Storage Manager (QSAN Storage Manager version 3.3.1 and earlier per CNVD/CNNVD ...

CVE-2021-32523 QSAN Storage Manager - Improper Authorization

Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32522 QSAN Storage Manager, XEVO, SANOS - Improper Restriction of Excessive Authentication Attempts

Improper restriction of excessive authentication attempts vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to discover users’ credentials and obtain access via a brute force attack. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32521

CVE-2021-32521 affects QSAN Storage Manager, XEVO and SANOS. Vulnerability arises from using MAC addresses as authenticated passwords, enabling local privilege escalation by a non-remote attacker. Documented impact is privilege escalation with trusted access to QSAN products; exploitation is loca...

CVE-2021-32520

The CVE-2021-32520 entry concerns QSAN Storage Manager (QSAN NAS OS) and a hard-coded cryptographic key vulnerability. The root cause is use of a hard-coded encryption key, which could allow an attacker to obtain user credentials and related permissions. The available documents consistently descr...

CVE-2021-32520 QSAN Storage Manager - Use of Hard-coded Cryptographic Key

Use of hard-coded cryptographic key vulnerability in QSAN Storage Manager allows attackers to obtain users’ credentials and related permissions. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32519 QSAN Storage Manager, XEVO, SANOS - Use of Password Hash With Insufficient Computational Effort

Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to recover the plain-text password by brute-forcing the MD5 hash. The referred vulnerability has been solved with the updated version of QSAN Storage Manager...

CVE-2021-32519

CVE-2021-32519 affects QSAN Storage Manager, XEVO, and SANOS where password hashes were computed with insufficient computational effort (MD5), enabling remote attackers to recover plaintext passwords. Root cause: MD5 hashing with low iterations/weak protection. Impact: unauthorized disclosure of ...

CVE-2021-32518 QSAN Storage Manager - UNIX Symbolic Link (Symlink) Following

A vulnerability in sharelink in QSAN Storage Manager allows remote attackers to create a symbolic link then access arbitrary files. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

CVE-2021-32518

CVE-2021-32518 affects QSAN Storage Manager (QSAN Storage Manager) where the share_link functionality can be abused by remote attackers to create a symbolic link and access arbitrary files. This is a symbolic-link (symlink) following issue exposed via the share_link path; the root cause is not ex...

CVE-2021-32517 QSAN Storage Manager - Improper Access Control

Improper access control vulnerability in sharelink in QSAN Storage Manager allows remote attackers to download arbitrary files using particular parameter in download function. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

CVE-2021-32517

QSAN Storage Manager vulnerable in the share_link feature where improper access control allows remote attackers to download arbitrary files via a specific parameter in the download function. Affected versions are prior to 3.3.3; when updated to v3.3.3, the issue is addressed. Public sources from ...

CVE-2021-32516

Summary: CVE-2021-32516 describes a path traversal in the share_link component of QSAN Storage Manager, allowing remote attackers to download arbitrary files. The vulnerability affects QSAN Storage Manager 3.3.1 and earlier (CNVD/CNNVD notes) and is mitigated by upgrading to version 3.3.3 as cite...

CVE-2021-32516 QSAN Storage Manager - Path Traversal

Path traversal vulnerability in sharelink in QSAN Storage Manager allows remote attackers to download arbitrary files. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

CVE-2021-32515 QSAN Storage Manager - Exposure of Information Through Directory Listing

Directory listing vulnerability in sharelink in QSAN Storage Manager allows attackers to list arbitrary directories and further access credential information. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

CVE-2021-32515

QSAN Storage Manager (QSAN NAS OS by Quantium Technologies) contains a directory traversal flaw in the share_link component that lets an attacker list arbitrary directories and access credential information. Affected versions are 3.3.1 and earlier; remediation is upgrading to v3.3.3 (the fixed re...