CVE-2021-34351
Critical
Description
A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later
SeverityCritical
CVSS9.8
Exploit probability74. percentile1.5%
Product
Qnap Qvr
PublishedSep 27, 2021
First seenSep 27, 2021
Weakness typeCWE-78OS command injection
How to fix
Update
- qnap qvr5.1.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| qnap qvr | v < 5.1.5 | 5.1.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.