Read the docs
TI-2021-09799 Aliases CVE-2021-28807GHSA-4g4m-4574-88xm

Post-Authentication Reflected XSS Vulnerability in Q'center

Priority LOW 36CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already fixed this vulnerability in the following versions of Q’center: QTS 4.5.3: Q’center v1.12.1012 and later QTS 4.3.6: Q’center v1.10.1004 and later QTS 4.3.3: Q’center v1.10.1004 and later QuTS hero h4.5.2: Q’center v1.12.1012 and later QuTScloud c4.5.4: Q’center v1.12.1012 and later

Why it matters now

EPSS 0.0138 72nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Q’center (QNAP Systems Inc.): v1.12.1012, v1.10.1004

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQ’centerbefore v1.12.1012v1.12.1012Patch availableCNA
QNAPQ’centerbefore v1.10.1004v1.10.1004Patch availableCNA
QNAPQ’centerbefore v1.10.1004v1.10.1004Patch availableCNA
QNAPQ’centerbefore v1.12.1012v1.12.1012Patch availableCNA
QNAPQ’centerbefore v1.12.1012v1.12.1012Patch availableCNA
  • Q’center VendorQNAP Affected before v1.12.1012 Fixed in v1.12.1012 Patch available CNA
  • Q’center VendorQNAP Affected before v1.10.1004 Fixed in v1.10.1004 Patch available CNA
  • Q’center VendorQNAP Affected before v1.10.1004 Fixed in v1.10.1004 Patch available CNA
  • Q’center VendorQNAP Affected before v1.12.1012 Fixed in v1.12.1012 Patch available CNA
  • Q’center VendorQNAP Affected before v1.12.1012 Fixed in v1.12.1012 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:qnap:q\'center:*:*:*:*:*:*:*:*before 1.12.1012VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.3:*:*:*:*:*:*:*4.5.3Running onQNAP
cpe:2.3:a:qnap:q\'center:*:*:*:*:*:*:*:*before 1.10.1004VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*4.3.3Running onQNAP
cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*4.3.6Running onQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.2:*:*:*:*:*:*:*h4.5.2Running onQNAP
cpe:2.3:o:qnap:qutscloud:c4.5.4:*:*:*:*:*:*:*c4.5.4Running onQNAP
  • cpe:2.3:a:qnap:q\'center:*:*:*:*:*:*:*:* Versions before 1.12.1012 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.3:*:*:*:*:*:*:* Versions 4.5.3 Running on ·QNAP
  • cpe:2.3:a:qnap:q\'center:*:*:*:*:*:*:*:* Versions before 1.10.1004 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:* Versions 4.3.3 Running on ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:* Versions 4.3.6 Running on ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.2:*:*:*:*:*:*:* Versions h4.5.2 Running on ·QNAP
  • cpe:2.3:o:qnap:qutscloud:c4.5.4:*:*:*:*:*:*:* Versions c4.5.4 Running on ·QNAP

Remediation

  • Fix · CNA Q’center (QNAP Systems Inc.) Fixed in v1.12.1012
  • Fix · CNA Q’center (QNAP Systems Inc.) Fixed in v1.10.1004
  • Fix · CNA Q’center (QNAP Systems Inc.) Fixed in v1.10.1004
  • Fix · CNA Q’center (QNAP Systems Inc.) Fixed in v1.12.1012
  • Fix · CNA Q’center (QNAP Systems Inc.) Fixed in v1.12.1012

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-28807
  2. 2026-10-03 Alias added: GHSA-4g4m-4574-88xm

References

Exploit 2

Advisory 1

  • TI-2018-00661 Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and… CVSS 3.0HIGH 8.8
  • TI-2018-00662 OS command injection in QNAP Q'center Virtual Appliance CVSS 3.0HIGH 7.2
  • TI-2018-00663 OS command injection in QNAP Q'center Virtual Appliance CVSS 3.0HIGH 8.8
  • TI-2018-00665 OS command injection in QNAP Q'center Virtual Appliance CVSS 3.0HIGH 8.8
  • TI-2018-00664 OS command injection in QNAP Q'center Virtual Appliance CVSS 3.0HIGH 8.8
  • TI-2021-09795 Stored XSS Vulnerability in Q'center CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences