Stack Based Overflow Vulnerability in NVR Storage Expansion (QNAP Systems Inc. NVR Storage Expansion)
En bref
- Source
- NVD
- EPSS
- EPSS 1.58 % · centile 76 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- qnap
- Statut NVD
- Modified
Description
A stack buffer overflow vulnerability has been reported to affect QNAP device running NVR Storage Expansion. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of NVR Storage Expansion: NVR Storage Expansion 1.0.6 ( 2021/08/03 ) and later
Faiblesses (CWE)
- CWE-787 — Écriture hors limites
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | qnap |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · security@qnapsecurity.com.tw (Secondary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2021-21005
- GCVE · GCVE-0-2021-34345
Avis du CERT-FR
- CERTFR-2021-AVI-693 — Multiples vulnérabilités dans les produits Qnap · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:qnap:ej1600_firmware:*:*:*:*:*:*:*:*< 1.0.6cpe:2.3:o:qnap:tl-r1620sdc_firmware:*:*:*:*:*:*:*:*< 1.0.6cpe:2.3:o:qnap:tl-r1620sep-rp_firmware:*:*:*:*:*:*:*:*< 1.0.6cpe:2.3:o:qnap:tl-r1220sep-rp_firmware:*:*:*:*:*:*:*:*< 1.0.6cpe:2.3:o:qnap:tl-d1600s_firmware:*:*:*:*:*:*:*:*< 1.0.6cpe:2.3:o:qnap:tl-d800s_firmware:*:*:*:*:*:*:*:*< 1.0.6cpe:2.3:o:qnap:tl-d400s_firmware:*:*:*:*:*:*:*:*< 1.0.6cpe:2.3:o:qnap:tl-r1200s-rp_firmware:*:*:*:*:*:*:*:*< 1.0.6cpe:2.3:o:qnap:tl-r400s_firmware:*:*:*:*:*:*:*:*< 1.0.6cpe:2.3:o:qnap:tl-r1200c-rp_firmware:*:*:*:*:*:*:*:*< 1.0.6cpe:2.3:o:qnap:tl-d800c_firmware:*:*:*:*:*:*:*:*< 1.0.6cpe:2.3:o:qnap:tr-004_firmware:*:*:*:*:*:*:*:*< 1.0.6cpe:2.3:o:qnap:tr-002_firmware:*:*:*:*:*:*:*:*< 1.0.6cpe:2.3:o:qnap:tr-004u_firmware:*:*:*:*:*:*:*:*< 1.0.6
Produits affectés
| Produit | Versions |
|---|---|
| QNAP Systems Inc. · NVR Storage Expansion | affected unspecified < 1.0.6 ( 2021/08/03 ) |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |