CVE-2021-32535criticalCWE-798

CVE-2021-32535: critical vulnerability in QSAN SANOS

QSAN SANOS - Use of Hard-coded Credentials

Published · Updated

Follow this CVE+ Monitor SANOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 1.4%
In short

QSAN SANOS storage systems contain hard-coded default administrator credentials that cannot be changed, allowing anyone on the network to log in with full admin access and take complete control of the system.

Technical detail

CWE-798 hard-coded credentials in QSAN SANOS enable unauthenticated remote attackers to obtain administrative privileges without authentication. The vulnerability permits execution of arbitrary administrative functions on affected systems prior to v2.1.0, with no pre-conditions beyond network access.

Summary generated and translated by AI from the official description.
The vulnerability of hard-coded default credentials in QSAN SANOS allows unauthenticated remote attackers to obtain administrator’s permission and execute arbitrary functions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
QSAN · SANOS
Related CVEs — QSAN SANOS

In the same product, most dangerous first.

CVE-2021-32529CRITICALQSAN XEVO, SANOS - Command Injection -1EPSS 2.3%CVE-2021-32534CRITICALQSAN SANOS - Command InjectionEPSS 1.9%CVE-2021-32533CRITICALQSAN SANOS - Command InjectionEPSS 1.9%CVE-2021-32522CRITICALQSAN Storage Manager, XEVO, SANOS - Improper Restriction of Excessive Authentication AttemptsEPSS 1.4%CVE-2021-32519CRITICALQSAN Storage Manager, XEVO, SANOS - Use of Password Hash With Insufficient Computational EffortEPSS 0.9%CVE-2021-32521HIGHQSAN Storage Manager, XEVO, SANOS - Use of Hard-coded PasswordEPSS 0.7%