Threat Investigation
Request a demo

CVE-2021-28807

High

Description

A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already fixed this vulnerability in the following versions of Q’center: QTS 4.5.3: Q’center v1.12.1012 and later QTS 4.3.6: Q’center v1.10.1004 and later QTS 4.3.3: Q’center v1.10.1004 and later QuTS hero h4.5.2: Q’center v1.12.1012 and later QuTScloud c4.5.4: Q’center v1.12.1012 and later

SeverityHigh
CVSS7.7
Exploit probability—
ProductQnap Q\'center
PublishedJun 3, 2021
First seenJun 3, 2021
Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update
  • qnap q\'center1.12.1012, 1.10.1004 or later

Affected products

ProductAffected versionsFixed in
qnap q\'centerv < 1.12.1012, v < 1.10.10041.12.1012, 1.10.1004

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.