Read the docs
TI-2021-09807 Aliases CVE-2021-28816GHSA-pp5r-cwfq-7whf

Stack Buffer Overflow Vulnerabilities in QTS, QuTS hero, and QuTScloud

Priority MEDIUM 40CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QTS, QuTScloud, QuTS hero: QTS 4.5.4.1715 build 20210630 and later QTS 5.0.0.1716 build 20210701 and later QTS 4.3.3.1693 build 20210624 and later QTS 4.3.6.1750 build 20210730 and later QuTScloud c4.5.6.1755 and later QuTS hero h4.5.4.1771 build 20210825 and later

Why it matters now

EPSS 0.00928 60th percentileScored 2026-11-07
Fix Fixed QTS (QNAP Systems Inc.): 4.5.4.1715 build 20210630, 5.0.0.1716 build 20210701, 4.3.3.1693 build 20210624 +1QuTScloud (QNAP Systems Inc.): c4.5.6.1755+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQTSbefore 4.5.4.1715 build 20210630; before 5.0.0.1716 build 20210701; before 4.3.3.1693 build 20210624; before 4.3.6.1750 build 202107304.5.4.1715 build 20210630, 5.0.0.1716 build 20210701, 4.3.3.1693 build 20210624, 4.3.6.1750 build 20210730Patch availableCNA
QNAPQuTScloudbefore c4.5.6.1755c4.5.6.1755Patch availableCNA
QNAPQuTS herobefore h4.5.4.1771 build 20210825h4.5.4.1771 build 20210825Patch availableCNA
  • QTS VendorQNAP Affected before 4.5.4.1715 build 20210630; before 5.0.0.1716 build 20210701; before 4.3.3.1693 build 20210624; before 4.3.6.1750 build 20210730 Fixed in 4.5.4.1715 build 20210630, 5.0.0.1716 build 20210701, 4.3.3.1693 build 20210624, 4.3.6.1750 build 20210730 Patch available CNA
  • QuTScloud VendorQNAP Affected before c4.5.6.1755 Fixed in c4.5.6.1755 Patch available CNA
  • QuTS hero VendorQNAP Affected before h4.5.4.1771 build 20210825 Fixed in h4.5.4.1771 build 20210825 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*before 4.3.3.1693; 4.3.4 to before 4.3.6.1750; 4.4.0 to before 4.5.4.1715; 5.0.0 to before 5.0.0.1716VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*before h4.5.4.1771VulnerableQNAP
cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*before c4.5.6.1755VulnerableQNAP
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* Versions before 4.3.3.1693; 4.3.4 to before 4.3.6.1750; 4.4.0 to before 4.5.4.1715; 5.0.0 to before 5.0.0.1716 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:* Versions before h4.5.4.1771 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:* Versions before c4.5.6.1755 Vulnerable ·QNAP

Remediation

  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.5.4.1715 build 20210630, 5.0.0.1716 build 20210701, 4.3.3.1693 build 20210624, 4.3.6.1750 build 20210730
  • Fix · CNA QuTScloud (QNAP Systems Inc.) Fixed in c4.5.6.1755
  • Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h4.5.4.1771 build 20210825

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    QNAP Systems QuTS hero h4.5.4.1771 build 20210825

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2021-13385 Buffer Overflow Vulnerability in QTS, QuTS hero, and QuTScloudPriority LOW 36
    • TI-2018-14145 Insufficient HTTP Security Headers in QTS, QuTS hero, and QuTScloudPriority LOW 28
    Show all 3 records →
  • Release ·

    QNAP Systems QuTScloud c4.5.6.1755

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2021-13385 Buffer Overflow Vulnerability in QTS, QuTS hero, and QuTScloudPriority LOW 36
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-28816
  2. 2026-10-03 Alias added: GHSA-pp5r-cwfq-7whf

References

Advisory 1

  • TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
See all 282 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences