CVE-2021-28812

CWE-77 — Command InjectionCWE-78 — OS Command InjectionCWE-12863 documents3 sources
Severity
8.8HIGH
EPSS
2.4%
top 15.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Qnap Systems Inc. Video StationQnap Video Station
Timeline
PublishedJun 3
Latest updateMay 24

Description

A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Video Station versions prior to 5.5.4 on QTS 4.5.2; versions prior to 5.5.4 on QuTS hero h4.5.2; versions prior to 5.5.4 on QuTScloud c4.5.4. This issue does not affect: QNAP Systems Inc. Video Station on QTS 4.3.6; on QTS 4.3.3.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5qnap_systems_inc./video_stationunspecified — 5.5.4
▶NVDqnap/video_station< 5.5.4

🔴Vulnerability Details

2
GHSA
GHSA-c2r6-6wr8-rvc4: A command injection vulnerability has been reported to affect certain versions of Video Station↗2022-05-24
▶
CVEList
Command Injection Vulnerability in Video Station↗2021-06-03
▶
CVE-2021-28812 (HIGH CVSS 8.8) | A command injection vulnerability h | cvebase.io