CVE-2021-32530: critical vulnerability in QSAN XEVO
QSAN XEVO - Command Injection Following via Array function
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in QSAN XEVO's Array function allows attackers to inject and execute arbitrary system commands by manipulating the status parameter, without needing to log in. This lets unauthorized users take complete control of the system.
OS command injection vulnerability exists in the Array function due to insufficient input validation on the status parameter, allowing remote unauthenticated attackers to inject malicious commands that are executed with system privileges. The vulnerability requires network access to the vulnerable endpoint but no authentication, resulting in arbitrary code execution and complete system compromise.
In the same product, most dangerous first.