CVE-2021-32524criticalCWE-78

CVE-2021-32524: critical vulnerability in QSAN Storage Manager

QSAN Storage Manager - Command Injection-3

Published · Updated

Follow this CVE+ Monitor Storage Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 1.7%
In short

A flaw in QSAN Storage Manager allows attackers with admin access to run any commands they want on the system. This is dangerous because attackers can take complete control of the storage device.

Technical detail

CWE-78 command injection vulnerability in QSAN Storage Manager allows authenticated privileged users to execute arbitrary system commands through unsanitized input in administrative functions. Exploitation requires valid administrative credentials; successful exploitation results in complete system compromise and arbitrary code execution.

Summary generated and translated by AI from the official description.
Command injection vulnerability in QSAN Storage Manager allows remote privileged users to execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
QSAN · Storage Manager
Related CVEs — QSAN Storage Manager

In the same product, most dangerous first.

CVE-2021-32513CRITICALQSAN Storage Manager - Command Injection Following via QsanTorture functionEPSS 2.1%CVE-2021-32512CRITICALQSAN Storage Manager - Command Injection Following via QuickInstall functionEPSS 2.1%CVE-2021-32527HIGHQSAN Storage Manager - Path Traversal-2EPSS 1.7%CVE-2021-32525CRITICALQSAN Storage Manager - Use of Hard-coded Password-2EPSS 1.7%CVE-2021-32518HIGHQSAN Storage Manager - UNIX Symbolic Link (Symlink) FollowingEPSS 1.7%CVE-2021-32516HIGHQSAN Storage Manager - Path TraversalEPSS 1.7%