CVE-2021-32529criticalCWE-77

CVE-2021-32529: critical vulnerability in QSAN XEVO

QSAN XEVO, SANOS - Command Injection -1

Published · Updated

Follow this CVE+ Monitor SANOS+ Monitor XEVO

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 2.3%
In short

A flaw in QSAN XEVO and SANOS storage systems allows attackers to run unauthorized commands without logging in. This puts your data and system completely at risk.

Technical detail

Remote unauthenticated command injection vulnerability in QSAN XEVO and SANOS storage systems (CWE-77) permits arbitrary command execution via unsanitized input. No authentication required; attacker can directly compromise system integrity and confidentiality. CVSS 9.8 reflects critical severity with network accessibility and no user interaction required.

Summary generated and translated by AI from the official description.
Command injection vulnerability in QSAN XEVO, SANOS allows remote unauthenticated attackers to execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
QSAN · SANOSQSAN · XEVO
Related CVEs — QSAN XEVO

In the same product, most dangerous first.

CVE-2021-32530CRITICALQSAN XEVO - Command Injection Following via Array functionEPSS 2.3%CVE-2021-32531CRITICALQSAN XEVO - Command Injection Following via Init functionEPSS 2.1%CVE-2021-32534CRITICALQSAN SANOS - Command InjectionEPSS 1.9%CVE-2021-32533CRITICALQSAN SANOS - Command InjectionEPSS 1.9%CVE-2021-32532HIGHQSAN XEVO - Path TraversalEPSS 1.7%CVE-2021-32535CRITICALQSAN SANOS - Use of Hard-coded CredentialsEPSS 1.4%