Read the docs
TI-2021-13401 Aliases CVE-2021-34362GHSA-rfgr-8gxv-c42h

Command Injection Vulnerability in Media Streaming Add-on

Priority MEDIUM 40CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A command injection vulnerability has been reported to affect QNAP device running Media Streaming add-on. If exploited, this vulnerability allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of Media Streaming add-on: QTS 5.0.0: Media Streaming add-on 500.0.0.3 ( 2021/08/20 ) and later QTS 4.5.4: Media Streaming add-on 500.0.0.3 ( 2021/08/20 ) and later QTS 4.3.6: Media Streaming add-on 430.1.8.12 ( 2021/08/20 ) and later QTS 4.3.3: Media Streaming add-on 430.1.8.12 ( 2021/09/29 ) and later QuTS-Hero 5.0.0: Media Streaming add-on 500.0.0.3 ( 2021/08/20 ) and later

Why it matters now

EPSS 0.01266 69th percentileScored 2026-11-07
Fix Fixed Media Streaming add-on (QNAP Systems Inc.): 500.0.0.3 ( 2021/08/20 ), 430.1.8.12 ( 2021/08/20 ), 430.1.8.12 ( 2021/09/29 )

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPMedia Streaming add-onbefore 500.0.0.3 ( 2021/08/20 )500.0.0.3 ( 2021/08/20 )Patch availableCNA
QNAPMedia Streaming add-onbefore 500.0.0.3 ( 2021/08/20 )500.0.0.3 ( 2021/08/20 )Patch availableCNA
QNAPMedia Streaming add-onbefore 500.0.0.3 ( 2021/08/20 )500.0.0.3 ( 2021/08/20 )Patch availableCNA
QNAPMedia Streaming add-onbefore 430.1.8.12 ( 2021/08/20 )430.1.8.12 ( 2021/08/20 )Patch availableCNA
QNAPMedia Streaming add-onbefore 430.1.8.12 ( 2021/09/29 )430.1.8.12 ( 2021/09/29 )Patch availableCNA
  • Media Streaming add-on VendorQNAP Affected before 500.0.0.3 ( 2021/08/20 ) Fixed in 500.0.0.3 ( 2021/08/20 ) Patch available CNA
  • Media Streaming add-on VendorQNAP Affected before 500.0.0.3 ( 2021/08/20 ) Fixed in 500.0.0.3 ( 2021/08/20 ) Patch available CNA
  • Media Streaming add-on VendorQNAP Affected before 500.0.0.3 ( 2021/08/20 ) Fixed in 500.0.0.3 ( 2021/08/20 ) Patch available CNA
  • Media Streaming add-on VendorQNAP Affected before 430.1.8.12 ( 2021/08/20 ) Fixed in 430.1.8.12 ( 2021/08/20 ) Patch available CNA
  • Media Streaming add-on VendorQNAP Affected before 430.1.8.12 ( 2021/09/29 ) Fixed in 430.1.8.12 ( 2021/09/29 ) Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:qnap:media_streaming_add-on:*:*:*:*:*:*:*:*before 500.0.0.3VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4:*:*:*:*:*:*:*4.5.4Running onQNAP
cpe:2.3:o:qnap:qts:5.0.0:*:*:*:*:*:*:*5.0.0Running onQNAP
cpe:2.3:a:qnap:media_streaming_add-on:*:*:*:*:*:*:*:*before 430.1.8.12VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3:-:*:*:*:*:*:*4.3.3Running onQNAP
cpe:2.3:o:qnap:qts:4.3.6:-:*:*:*:*:*:*4.3.6Running onQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.4:*:*:*:*:*:*:*h4.5.4Running onQNAP
cpe:2.3:o:qnap:quts_hero:h5.0.0:*:*:*:*:*:*:*h5.0.0Running onQNAP
  • cpe:2.3:a:qnap:media_streaming_add-on:*:*:*:*:*:*:*:* Versions before 500.0.0.3 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4:*:*:*:*:*:*:* Versions 4.5.4 Running on ·QNAP
  • cpe:2.3:o:qnap:qts:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Running on ·QNAP
  • cpe:2.3:a:qnap:media_streaming_add-on:*:*:*:*:*:*:*:* Versions before 430.1.8.12 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3:-:*:*:*:*:*:* Versions 4.3.3 Running on ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6:-:*:*:*:*:*:* Versions 4.3.6 Running on ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.4:*:*:*:*:*:*:* Versions h4.5.4 Running on ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.0.0:*:*:*:*:*:*:* Versions h5.0.0 Running on ·QNAP

Remediation

  • Fix · CNA Media Streaming add-on (QNAP Systems Inc.) Fixed in 500.0.0.3 ( 2021/08/20 )
  • Fix · CNA Media Streaming add-on (QNAP Systems Inc.) Fixed in 500.0.0.3 ( 2021/08/20 )
  • Fix · CNA Media Streaming add-on (QNAP Systems Inc.) Fixed in 500.0.0.3 ( 2021/08/20 )
  • Fix · CNA Media Streaming add-on (QNAP Systems Inc.) Fixed in 430.1.8.12 ( 2021/08/20 )
  • Fix · CNA Media Streaming add-on (QNAP Systems Inc.) Fixed in 430.1.8.12 ( 2021/09/29 )

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-34362
  2. 2026-10-03 Alias added: GHSA-rfgr-8gxv-c42h

References

Advisory 1

  • TI-2023-09215 Command injection in QNAP Multimedia Console CVSS 3.1CRITICAL 9.8
  • TI-2017-05276 OS command injection in QNAP Media Streaming Add-On CVSS 3.0CRITICAL 9.8
  • TI-2020-18515 SQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-On CVSS 3.1CRITICAL 9.8
  • TI-2023-25540 Information disclosure in QNAP Media Streaming add-on CVSS 3.1CRITICAL 9.8
  • TI-2017-05277 QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections. CVSS 3.0HIGH 8.8
  • TI-2024-33828 Authorization bypass in QNAP Media Streaming add-on CVSS 4.0MEDIUM 6.9
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences