QSAN

Records31All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical15CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

QSAN records in CISA KEV

No QSAN vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Storage Manager 23 records MEDIUM Sanos 7 records MEDIUM Xevo 7 records MEDIUM Xn8008t Firmware 1 record LOW Xn8024r Firmware 1 record LOW

Records

7 records in Xevo · all components

TI-2021-12205 CVE-2021-32531 · GHSA-qrmg-m8r6-9cvr

QSAN XEVO - Command Injection Following via Init function

MEDIUM 46

OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary commands without permissions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02058 Published 2021-07-07 Fixed in 1.2.0 CWE-78

TI-2021-12204 CVE-2021-32530 · GHSA-whm9-h873-f559

QSAN XEVO - Command Injection Following via Array function

MEDIUM 46

OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated attackers to execute arbitrary commands via status parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02309 Published 2021-07-07 No fix listed CWE-78

TI-2021-12203 CVE-2021-32529 · GHSA-9xhc-jrfx-j7h5

QSAN XEVO, SANOS - Command Injection -1

MEDIUM 46

Command injection vulnerability in QSAN XEVO, SANOS allows remote unauthenticated attackers to execute arbitrary commands.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02264 Published 2021-07-07 Fixed in 1.2.0 CWE-77

TI-2021-12196 CVE-2021-32522 · GHSA-6p7h-4j4x-9m57

QSAN Storage Manager, XEVO, SANOS - Improper Restriction of Excessive Authentication Attempts

MEDIUM 45

Improper restriction of excessive authentication attempts vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to discover users’ credentials and obtain access via a brute force attack.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01388 Published 2021-07-07 Fixed in 1.2.0 CWE-307

TI-2021-12193 CVE-2021-32519 · GHSA-4qqf-xjmf-3h2v

QSAN Storage Manager, XEVO, SANOS - Use of Password Hash With Insufficient Computational Effort

MEDIUM 44

Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to recover the plain-text password by brute-forcing the MD5 hash.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00851 Published 2021-07-07 Fixed in 1.2.0 CWE-916

TI-2021-12195 CVE-2021-32521 · GHSA-gfjp-9255-98gh

QSAN Storage Manager, XEVO, SANOS - Use of Hard-coded Password

MEDIUM 43

Use of MAC address as an authenticated password in QSAN Storage Manager, XEVO, SANOS allows local attackers to escalate privileges.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00715 Published 2021-07-07 Fixed in 1.2.0 CWE-259

TI-2021-12206 CVE-2021-32532 · GHSA-8qpp-9h5v-3cfj

QSAN XEVO - Path Traversal

LOW 36

Path traversal vulnerability in back-end analysis function in QSAN XEVO allows remote attackers to download arbitrary files without permissions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01669 Published 2021-07-07 Fixed in 1.2.0 CWE-22

Open these records in search →

Critical	15
High	6
Medium	10
Low	0
No CVSS	0