CVE-2021-32512criticalCWE-78

CVE-2021-32512: critical vulnerability in QSAN Storage Manager

QSAN Storage Manager - Command Injection Following via QuickInstall function

Published · Updated

Follow this CVE+ Monitor Storage Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 2.1%
In short

QSAN Storage Manager's QuickInstall function allows attackers to run any command on the server without authentication. An attacker can exploit this by sending specially crafted requests to take complete control of the storage system.

Technical detail

The QuickInstall function in QSAN Storage Manager fails to properly sanitize user-supplied parameters, enabling OS command injection (CWE-78). Remote unauthenticated attackers can inject arbitrary shell commands through unfiltered parameters; exploitation requires network access to the vulnerable interface. Successful exploitation grants full system command execution with the privileges of the affected service.

Summary generated and translated by AI from the official description.
QuickInstall in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and execute arbitrary commands. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
QSAN · Storage Manager
Related CVEs — QSAN Storage Manager

In the same product, most dangerous first.

CVE-2021-32513CRITICALQSAN Storage Manager - Command Injection Following via QsanTorture functionEPSS 2.1%CVE-2021-32527HIGHQSAN Storage Manager - Path Traversal-2EPSS 1.7%CVE-2021-32524CRITICALQSAN Storage Manager - Command Injection-3EPSS 1.7%CVE-2021-32525CRITICALQSAN Storage Manager - Use of Hard-coded Password-2EPSS 1.7%CVE-2021-32518HIGHQSAN Storage Manager - UNIX Symbolic Link (Symlink) FollowingEPSS 1.7%CVE-2021-32516HIGHQSAN Storage Manager - Path TraversalEPSS 1.7%