PT-2022-5125

CVE-2021-38689

Published

2022-01-13

Updated

2022-01-25

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QNAP QVR Elite versions prior to 2.1.4.0 QNAP QVR Pro versions prior to 2.1.3.0 QNAP QVR Guard versions prior to 2.1.3.0

Description The issue is related to a stack buffer overflow vulnerability in the memory, which can be exploited by a remote attacker to execute arbitrary code. This vulnerability affects QNAP devices running QVR Elite, QVR Pro, and QVR Guard.

Recommendations For QNAP QVR Elite versions prior to 2.1.4.0, update to version 2.1.4.0 or later. For QNAP QVR Pro versions prior to 2.1.3.0, update to version 2.1.3.0 or later. For QNAP QVR Guard versions prior to 2.1.3.0, update to version 2.1.3.0 or later.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-787: Out-of-bounds Write

CWE-121: Stack-based Buffer Overflow

CWE-120: Buffer Copy without Checking Size of Input (\'Classic Buffer Overflow\')

Related identifiers

CVE-2021-38689