CVE-2021-32521highCWE-259

CVE-2021-32521: high-severity vulnerability in QSAN Storage Manager

QSAN Storage Manager, XEVO, SANOS - Use of Hard-coded Password

Published · Updated

Follow this CVE+ Monitor Storage Manager+ Monitor SANOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.3epss 0.7%
Use of MAC address as an authenticated password in QSAN Storage Manager, XEVO, SANOS allows local attackers to escalate privileges. Suggest contacting with QSAN and refer to recommendations in QSAN Document.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
QSAN · SANOSQSAN · Storage ManagerQSAN · XEVO
Related CVEs — QSAN Storage Manager

In the same product, most dangerous first.

CVE-2021-32530CRITICALQSAN XEVO - Command Injection Following via Array functionEPSS 2.3%CVE-2021-32529CRITICALQSAN XEVO, SANOS - Command Injection -1EPSS 2.3%CVE-2021-32513CRITICALQSAN Storage Manager - Command Injection Following via QsanTorture functionEPSS 2.1%CVE-2021-32512CRITICALQSAN Storage Manager - Command Injection Following via QuickInstall functionEPSS 2.1%CVE-2021-32531CRITICALQSAN XEVO - Command Injection Following via Init functionEPSS 2.1%CVE-2021-32534CRITICALQSAN SANOS - Command InjectionEPSS 1.9%