CVE-2021-38687

A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Surveillance Station: QTS 5.0.0 (64 bit): Surveillance Station 5.2.0.4.2 ( 2021/10/26 ) and later QTS 5.0.0 (32 bit): Surveillance Station 5.2.0.3.2 ( 2021/10/26 ) and later QTS 4.3.6 (64 bit): Surveillance Station 5.1.5.4.6 ( 2021/10/26 ) and later QTS 4.3.6 (32 bit): Surveillance Station 5.1.5.3.6 ( 2021/10/26 ) and later QTS 4.3.3: Surveillance Station 5.1.5.3.6 ( 2021/10/26 ) and later

Score

CVSS 3.1 9.8 Critical

Status

Modified - security@qnapsecurity.com.tw

Published

2021-12-29

Last modified

2024-09-16

Weaknesses

CWE-120

Affected products

• Surveillance Station (Qnap)
• Surveillance Station (Qnap Systems Inc.)

References

• https://www.qnap.com/en/security-advisory/qsa-21-46