CVE-2021-34351

Name of the Vulnerable Software and Affected Versions QNAP QVR versions prior to 5.1.5 build 20210803

Description A command injection issue has been reported, affecting QNAP devices running QVR. This could allow remote attackers to run arbitrary commands if exploited. The issue is related to the lack of neutralization of special elements used in the OS command.

Recommendations For QNAP QVR versions prior to 5.1.5 build 20210803, update to QVR 5.1.5 build 20210803 or later to resolve the issue. As a temporary workaround, consider restricting access to the QVR system to minimize the risk of exploitation.