TI-2021-13390 Aliases CVE-2021-34349 GHSA-gh92-qxhf-5994

Command Injection Vulnerability in QVR

LOW 35CWE-78Published 2021-09-27 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later

Why it matters now

EPSS 0.0145 73rd percentileScored 2026-11-07

Fix Fixed QVR (QNAP Systems Inc.): 5.1.5 build 20210803

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
QNAP	QVR	before 5.1.5 build 20210803	5.1.5 build 20210803	Patch available	CNA

QVR VendorQNAP Affected before 5.1.5 build 20210803 Fixed in 5.1.5 build 20210803 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:qnap:qvr::::::::	before 5.1.5	Vulnerable	QNAP

cpe:2.3:a:qnap:qvr:*:*:*:*:*:*:*:* Versions before 5.1.5 Vulnerable ·QNAP

Remediation

Fix · CNA QVR (QNAP Systems Inc.) Fixed in 5.1.5 build 20210803

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2021-09-27
QNAP Systems QVR 5.1.5 build 20210803
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-13391 Command Injection Vulnerability in QVRPriority MEDIUM 45
- TI-2021-13389 Command Injection Vulnerability in QVRPriority MEDIUM 45
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2021-34349
2026-10-03 Alias added: GHSA-gh92-qxhf-5994

References

Advisory 1

https://www.qnap.com/en/security-advisory/qsa-21-35

TI-2025-32893 Improper authentication in QNAP VioStor CVSS 4.0CRITICAL 9.3
TI-2022-10579 Vulnerability in QVR CVSS 3.1CRITICAL 9.8
TI-2021-16256 Command Injection Vulnerability in VioStor CVSS 3.1CRITICAL 9.8
TI-2021-13392 Command Injection Vulnerability in QVR CVSS 3.1CRITICAL 9.8
TI-2021-13391 Command Injection Vulnerability in QVR CVSS 3.1CRITICAL 9.8
TI-2021-13389 Command Injection Vulnerability in QVR CVSS 3.1CRITICAL 9.8

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences