CVE-2021-44051

published 2022-05-05

CVE-2021-44051: A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows remote…

Priority P2 63 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 5.0.0.1986 build 20220324 and later

Affected

12 ranges

Vendor	Product	Version range	Fixed in
qnap	qts	—	—
qnap	qts	>= 4.3.3.0174 < 4.3.3.1945	4.3.3.1945
qnap	qts	>= 4.3.4.0899 < 4.3.4.1976	4.3.4.1976
qnap	qts	>= 4.3.6.0895 < 4.3.6.1965	4.3.6.1965
qnap	qts	>= 4.4.0.0883 < 4.5.4.1991	4.5.4.1991
qnap	qts	>= 5.0.0.1716 < 5.0.0.1986	5.0.0.1986
qnap	quts_hero	< h4.5.4.1771	h4.5.4.1771
qnap	quts_hero	>= h5.0.0.1772 < h5.0.0.1986	h5.0.0.1986
qnap	qutscloud	< c5.0.1.1998	c5.0.1.1998
qnap_systems_inc	qts	>= unspecified < 5.0.0.1986 build 20220324	5.0.0.1986 build 20220324
qnap_systems_inc	quts_hero	>= unspecified < h5.0.0.1986 build 20220324	h5.0.0.1986 build 20220324
qnap_systems_inc	qutscloud	>= unspecified < c5.0.1.1949	c5.0.1.1949

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-77