QNAP NAS Remote Code Execution Vulnerability

Impact

• Remote Code Execution

System / Technologies affected

• QVR 5.1.5 build prior to 20210902

Solutions

Before installation of the software, please visit the vendor web-site for more details.

• Apply fixes issued by the vendor:
  QVR 5.1.5 build 20210902 and later

Updating QVR

1. Log on to QVR as administrator.
2. Go to Control Panel > System Settings > Firmware Update.
3. Under Live Update, click Check for Update.
   QVR downloads and installs the latest available update.

Tip: You can also download the update from the QNAP website. Go to Support > Download Center and then perform a manual update for your specific device.

Vulnerability Identifier

• CVE-2021-34352

Source

• QNAP
• SecurityWizardry

Related Link

• https://www.securitywizardry.com/the-radar-page/alert-details#alerts
• https://www.qnap.com/en/security-advisory/qsa-21-38