CVE-2021-32533criticalCWE-78

CVE-2021-32533: critical vulnerability in QSAN SANOS

QSAN SANOS - Command Injection

Published · Updated

Follow this CVE+ Monitor SANOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 1.9%
In short

The QSAN SANOS settings page fails to filter user input, allowing attackers to inject and run arbitrary commands on the system. This is critical because it gives complete control of the device to unauthorized users.

Technical detail

CWE-78 command injection via unfiltered parameters in the SANOS settings interface allows unauthenticated remote code execution with no special privileges required (CVSS 9.8). Attack vector exploits insufficient input validation in the web administration panel to achieve system-level command execution.

Summary generated and translated by AI from the official description.
The QSAN SANOS setting page does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
QSAN · SANOS
Related CVEs — QSAN SANOS

In the same product, most dangerous first.

CVE-2021-32529CRITICALQSAN XEVO, SANOS - Command Injection -1EPSS 2.3%CVE-2021-32534CRITICALQSAN SANOS - Command InjectionEPSS 1.9%CVE-2021-32535CRITICALQSAN SANOS - Use of Hard-coded CredentialsEPSS 1.4%CVE-2021-32522CRITICALQSAN Storage Manager, XEVO, SANOS - Improper Restriction of Excessive Authentication AttemptsEPSS 1.4%CVE-2021-32519CRITICALQSAN Storage Manager, XEVO, SANOS - Use of Password Hash With Insufficient Computational EffortEPSS 0.9%CVE-2021-32521HIGHQSAN Storage Manager, XEVO, SANOS - Use of Hard-coded PasswordEPSS 0.7%