CVE-2021-34362 — OS Command Injection in Systems INC Media Streaming Add-on

CWE-78 — OS Command InjectionCWE-77 — Command Injection9 documents6 sources
Severity
7.2HIGHNVD
CNA8.7
EPSS
0.9%
top 24.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Qnap Systems INC Media Streaming Add-onQnap Media Streaming Add-on
Timeline
PublishedOct 22
Latest updateMay 24

Description

A command injection vulnerability has been reported to affect QNAP device running Media Streaming add-on. If exploited, this vulnerability allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of Media Streaming add-on: QTS 5.0.0: Media Streaming add-on 500.0.0.3 ( 2021/08/20 ) and later QTS 4.5.4: Media Streaming add-on 500.0.0.3 ( 2021/08/20 ) and later QTS 4.3.6: Media Streaming add-on 430.1.8.12 ( 2021/08/20 ) and later QTS 4.3.3…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶NVDqnap/media_streaming_add-on< 500.0.0.3+1
▶CVEListV5qnap_systems_inc/media_streaming_add-onunspecified — 500.0.0.3 ( 2021/08/20 )+2

🔴Vulnerability Details

2
GHSA
GHSA-rfgr-8gxv-c42h: A command injection vulnerability has been reported to affect QNAP device running Media Streaming add-on↗2022-05-24
▶
CVEList
Command Injection Vulnerability in Media Streaming Add-on↗2021-10-22
▶