1. Home
  2. CVE Database
  3. CVE-2021-28812
HIGH · 8.8

CVE-2021-28812

A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affe...

Vulnerability Description

A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Video Station versions prior to 5.5.4 on QTS 4.5.2; versions prior to 5.5.4 on QuTS hero h4.5.2; versions prior to 5.5.4 on QuTScloud c4.5.4. This issue does not affect: QNAP Systems Inc. Video Station on QTS 4.3.6; on QTS 4.3.3.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
QnapVideo Station< 5.5.4
QnapQts4.5.2
QnapQuts Heroh4.5.2
QnapQutscloudc4.5.4

Related Weaknesses (CWE)

CWE-78CWE-77CWE-1286

References

FAQ

What is CVE-2021-28812?

CVE-2021-28812 is a vulnerability with a CVSS score of 8.8 (HIGH). A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affe...

How severe is CVE-2021-28812?

CVE-2021-28812 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-28812?

Check the references section above for vendor advisories and patch information. Affected products include: Qnap Video Station, Qnap Qts, Qnap Quts Hero, Qnap Qutscloud.