CVE-2021-28812

A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Video Station versions prior to 5.5.4 on QTS 4.5.2; versions prior to 5.5.4 on QuTS hero h4.5.2; versions prior to 5.5.4 on QuTScloud c4.5.4. This issue does not affect: QNAP Systems Inc. Video Station on QTS 4.3.6; on QTS 4.3.3.
References
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:qnap:video_station:*:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:4.5.2:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:a:qnap:video_station:*:*:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h4.5.2:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:a:qnap:video_station:*:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qutscloud:c4.5.4:*:*:*:*:*:*:*

History

18 Oct 2022, 20:57

Type Values Removed Values Added
CWE CWE-1286
CWE-78

11 Jun 2021, 17:34

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : 6.5
v3 : 8.8
CWE CWE-1286
CWE-78
CWE-77
CPE cpe:2.3:o:qnap:qts:4.5.2:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qutscloud:c4.5.4:*:*:*:*:*:*:*
cpe:2.3:a:qnap:video_station:*:*:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h4.5.2:*:*:*:*:*:*:*
References (MISC) https://www.qnap.com/zh-tw/security-advisory/qsa-21-21 - (MISC) https://www.qnap.com/zh-tw/security-advisory/qsa-21-21 - Vendor Advisory

03 Jun 2021, 03:15

Type Values Removed Values Added
New CVE

Information

Published : 2021-06-03 03:15

Updated : 2023-12-10 13:55


NVD link : CVE-2021-28812

Mitre link : CVE-2021-28812

CVE.ORG link : CVE-2021-28812


JSON object : View

Products Affected

qnap

  • qts
  • qutscloud
  • video_station
  • quts_hero
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-1286

Improper Validation of Syntactic Correctness of Input

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')