CVE-2021-32513criticalCWE-78

CVE-2021-32513: critical vulnerability in QSAN Storage Manager

QSAN Storage Manager - Command Injection Following via QsanTorture function

Published · Updated

Follow this CVE+ Monitor Storage Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 2.1%
In short

QSAN Storage Manager's QsanTorture function fails to validate user input, allowing attackers to inject and execute arbitrary commands on the server without authentication. This is critical because it gives complete control of the storage system to remote attackers.

Technical detail

CWE-78 command injection vulnerability in QsanTorture function due to insufficient input validation of special parameters. Remote unauthenticated attackers can inject OS commands through unfiltered parameters, achieving arbitrary command execution with system privileges. Fixed in QSAN Storage Manager v3.3.3.

Summary generated and translated by AI from the official description.
QsanTorture in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and execute arbitrary commands. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
QSAN · Storage Manager
Related CVEs — QSAN Storage Manager

In the same product, most dangerous first.

CVE-2021-32512CRITICALQSAN Storage Manager - Command Injection Following via QuickInstall functionEPSS 2.1%CVE-2021-32527HIGHQSAN Storage Manager - Path Traversal-2EPSS 1.7%CVE-2021-32524CRITICALQSAN Storage Manager - Command Injection-3EPSS 1.7%CVE-2021-32525CRITICALQSAN Storage Manager - Use of Hard-coded Password-2EPSS 1.7%CVE-2021-32518HIGHQSAN Storage Manager - UNIX Symbolic Link (Symlink) FollowingEPSS 1.7%CVE-2021-32516HIGHQSAN Storage Manager - Path TraversalEPSS 1.7%