CVE-2021-32523: critical vulnerability in QSAN Storage Manager
QSAN Storage Manager - Improper Authorization
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
QSAN Storage Manager has a flaw that allows privileged remote users to bypass security controls and run any commands they want on the system. This is dangerous because attackers with admin access could take full control of the storage system.
The vulnerability involves improper authorization checks in QSAN Storage Manager, enabling authenticated privileged users to circumvent access control mechanisms and execute arbitrary commands. Attack vector is network-based requiring prior privileged credentials; impact includes complete system compromise and unauthorized command execution.
In the same product, most dangerous first.