CVE-2021-44052

published 2022-05-05

CVE-2021-44052: An improper link resolution before file access ('Link Following') vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, and QTS…

Priority P3 50 high 8.1 CVSS 3.1

AV N AC L PR L UI N S U C H I H A N

An improper link resolution before file access ('Link Following') vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, and QTS. If exploited, this vulnerability allows remote attackers to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero, and QTS: QuTScloud c5.0.1.1998 and later QuTS hero h4.5.4.1971 build 20220310 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 4.3.4.1976 build 20220303 and later QTS 4.3.3.1945 build 20220303 and later QTS 4.2.6 build 20220304 and later QTS 4.3.6.1965 build 20220302 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later

Affected

18 ranges

Vendor	Product	Version range	Fixed in
qnap	qts	—	—
qnap	qts	>= 4.3.3.0174 < 4.3.3.1945	4.3.3.1945
qnap	qts	>= 4.3.4.0899 < 4.3.4.1976	4.3.4.1976
qnap	qts	>= 4.3.6.0895 < 4.3.6.1965	4.3.6.1965
qnap	qts	>= 4.4.0.0883 < 4.5.4.1991	4.5.4.1991
qnap	qts	>= 5.0.0.1716 < 5.0.0.1986	5.0.0.1986
qnap	quts_hero	< h4.5.4.1771	h4.5.4.1771
qnap	quts_hero	>= h5.0.0.1772 < h5.0.0.1986	h5.0.0.1986
qnap	qutscloud	< c5.0.1.1998	c5.0.1.1998
qnap_systems_inc	qts	>= unspecified < 4.3.4.1976 build 20220303	4.3.4.1976 build 20220303
qnap_systems_inc	qts	>= unspecified < 4.3.3.1945 build 20220303	4.3.3.1945 build 20220303
qnap_systems_inc	qts	>= unspecified < 4.2.6 build 20220304	4.2.6 build 20220304
qnap_systems_inc	qts	>= unspecified < 4.3.6.1965 build 20220302	4.3.6.1965 build 20220302
qnap_systems_inc	qts	>= unspecified < 5.0.0.1986 build 20220324	5.0.0.1986 build 20220324
qnap_systems_inc	qts	>= unspecified < 4.5.4.1991 build 20220329	4.5.4.1991 build 20220329
qnap_systems_inc	quts_hero	>= unspecified < h4.5.4.1971 build 20220310	h4.5.4.1971 build 20220310
qnap_systems_inc	quts_hero	>= unspecified < h5.0.0.1986 build 20220324	h5.0.0.1986 build 20220324
qnap_systems_inc	qutscloud	>= unspecified < c5.0.1.1998	c5.0.1.1998

CVSS provenance

nvd v3.1 8.1 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

nvd v2.0 5.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-59