CVE-2021-28798: A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to…

PriorityP344high7.5CVSS 3.1

AVNACLPRNUINSUCNIHAN

EPSS

0.94%

56.5th percentile

A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to modify files that impact system integrity. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.2.1630 Build 20210406 and later QTS 4.3.6.1663 Build 20210504 and later QTS 4.3.3.1624 Build 20210416 and later QuTS hero h4.5.2.1638 Build 20210414 and later QNAP NAS running QTS 4.5.3 are not affected.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
qnap	qts	>= 4.3.2.0144 < 4.3.3.1624	4.3.3.1624
qnap	qts	>= 4.3.4.0000 < 4.3.6.1663	4.3.6.1663
qnap	qts	>= 4.4.0000 < 4.5.2.1630	4.5.2.1630
qnap	quts_hero	< h4.5.2.1638	h4.5.2.1638
qnap_systems_inc	qts	>= unspecified < 4.5.2.1630 Build 20210406	4.5.2.1630 Build 20210406
qnap_systems_inc	qts	>= unspecified < 4.3.6.1663 Build 20210504	4.3.6.1663 Build 20210504
qnap_systems_inc	qts	>= unspecified < 4.3.3.1624 Build 20210416	4.3.3.1624 Build 20210416
qnap_systems_inc	quts_hero	>= unspecified < h4.5.2.1638 Build 20210414	h4.5.2.1638 Build 20210414

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.