CVE-2021-38682
Description
A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite, QVR Pro, QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 4.5.4: QVR Guard 2.1.3.0 and later QTS 5.0.0: QVR Guard 2.1.3.0 and later
How to fix
- qnap qvr_elite2.1.4.0 or later
- qnap qvr_guard2.1.3.0 or later
- qnap qvr_pro2.1.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| qnap qvr_elite | v < 2.1.4.0 | 2.1.4.0 |
| qnap qvr_guard | v < 2.1.3.0 | 2.1.3.0 |
| qnap qvr_pro | v < 2.1.3.0 | 2.1.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.