CVE-2021-34362

A command injection vulnerability has been reported to affect QNAP device running Media Streaming add-on. If exploited, this vulnerability allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of Media Streaming add-on: QTS 5.0.0: Media Streaming add-on 500.0.0.3 ( 2021/08/20 ) and later QTS 4.5.4: Media Streaming add-on 500.0.0.3 ( 2021/08/20 ) and later QTS 4.3.6: Media Streaming add-on 430.1.8.12 ( 2021/08/20 ) and later QTS 4.3.3: Media Streaming add-on 430.1.8.12 ( 2021/09/29 ) and later QuTS-Hero 5.0.0: Media Streaming add-on 500.0.0.3 ( 2021/08/20 ) and later
References
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:qnap:media_streaming_add-on:*:*:*:*:*:*:*:*
OR cpe:2.3:o:qnap:qts:4.5.4:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.0:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:a:qnap:media_streaming_add-on:*:*:*:*:*:*:*:*
OR cpe:2.3:o:qnap:qts:4.3.3:-:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:4.3.6:-:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:a:qnap:media_streaming_add-on:*:*:*:*:*:*:*:*
OR cpe:2.3:o:qnap:quts_hero:h4.5.4:*:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.0:*:*:*:*:*:*:*

Information

Published : 2021-10-22 05:15

Updated : 2021-11-02 15:48


NVD link : CVE-2021-34362

Mitre link : CVE-2021-34362


JSON object : View

Products Affected

qnap

  • quts_hero
  • qts
  • media_streaming_add-on
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')