Read the docs
TI-2021-16262 Aliases CVE-2021-38691GHSA-98m9-234r-rmcv

Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard

Priority MEDIUM 45CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite, QVR Pro, QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 4.5.4: QVR Guard 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Guard 2.1.3.0 (2021/12/06) and later

Why it matters now

EPSS 0.01339 71st percentileScored 2026-11-07
Fix Fixed QVR Elite (QNAP Systems Inc.): 2.1.4.0 (2021/12/06)QVR Pro (QNAP Systems Inc.): 2.1.3.0 (2021/12/06)+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQVR Elitebefore 2.1.4.0 (2021/12/06)2.1.4.0 (2021/12/06)Patch availableCNA
QNAPQVR Elitebefore 2.1.4.0 (2021/12/06)2.1.4.0 (2021/12/06)Patch availableCNA
QNAPQVR Elitebefore 2.1.4.0 (2021/12/06)2.1.4.0 (2021/12/06)Patch availableCNA
QNAPQVR Elitebefore 2.1.4.0 (2021/12/06)2.1.4.0 (2021/12/06)Patch availableCNA
QNAPQVR Probefore 2.1.3.0 (2021/12/06)2.1.3.0 (2021/12/06)Patch availableCNA
QNAPQVR Probefore 2.1.3.0 (2021/12/06)2.1.3.0 (2021/12/06)Patch availableCNA
QNAPQVR Guardbefore 2.1.3.0 (2021/12/06)2.1.3.0 (2021/12/06)Patch availableCNA
QNAPQVR Guardbefore 2.1.3.0 (2021/12/06)2.1.3.0 (2021/12/06)Patch availableCNA
  • QVR Elite VendorQNAP Affected before 2.1.4.0 (2021/12/06) Fixed in 2.1.4.0 (2021/12/06) Patch available CNA
  • QVR Elite VendorQNAP Affected before 2.1.4.0 (2021/12/06) Fixed in 2.1.4.0 (2021/12/06) Patch available CNA
  • QVR Elite VendorQNAP Affected before 2.1.4.0 (2021/12/06) Fixed in 2.1.4.0 (2021/12/06) Patch available CNA
  • QVR Elite VendorQNAP Affected before 2.1.4.0 (2021/12/06) Fixed in 2.1.4.0 (2021/12/06) Patch available CNA
  • QVR Pro VendorQNAP Affected before 2.1.3.0 (2021/12/06) Fixed in 2.1.3.0 (2021/12/06) Patch available CNA
  • QVR Pro VendorQNAP Affected before 2.1.3.0 (2021/12/06) Fixed in 2.1.3.0 (2021/12/06) Patch available CNA
  • QVR Guard VendorQNAP Affected before 2.1.3.0 (2021/12/06) Fixed in 2.1.3.0 (2021/12/06) Patch available CNA
  • QVR Guard VendorQNAP Affected before 2.1.3.0 (2021/12/06) Fixed in 2.1.3.0 (2021/12/06) Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:qnap:qvr_elite:*:*:*:*:*:*:*:*before 2.1.4.0VulnerableQNAP
cpe:2.3:a:qnap:qvr_guard:*:*:*:*:*:*:*:*before 2.1.3.0VulnerableQNAP
cpe:2.3:a:qnap:qvr_pro:*:*:*:*:*:*:*:*before 2.1.3.0VulnerableQNAP
  • cpe:2.3:a:qnap:qvr_elite:*:*:*:*:*:*:*:* Versions before 2.1.4.0 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:qvr_guard:*:*:*:*:*:*:*:* Versions before 2.1.3.0 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:qvr_pro:*:*:*:*:*:*:*:* Versions before 2.1.3.0 Vulnerable ·QNAP

Remediation

  • Fix · CNA QVR Elite (QNAP Systems Inc.) Fixed in 2.1.4.0 (2021/12/06)
  • Fix · CNA QVR Elite (QNAP Systems Inc.) Fixed in 2.1.4.0 (2021/12/06)
  • Fix · CNA QVR Elite (QNAP Systems Inc.) Fixed in 2.1.4.0 (2021/12/06)
  • Fix · CNA QVR Elite (QNAP Systems Inc.) Fixed in 2.1.4.0 (2021/12/06)
  • Fix · CNA QVR Pro (QNAP Systems Inc.) Fixed in 2.1.3.0 (2021/12/06)
  • Fix · CNA QVR Pro (QNAP Systems Inc.) Fixed in 2.1.3.0 (2021/12/06)
  • Fix · CNA QVR Guard (QNAP Systems Inc.) Fixed in 2.1.3.0 (2021/12/06)
  • Fix · CNA QVR Guard (QNAP Systems Inc.) Fixed in 2.1.3.0 (2021/12/06)

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    QNAP Systems QVR Elite, QVR Pro 2.1.3.0 (2021/12/06), 2.1.4.0 (2021/12/06)

    5 records Highest priority Priority MEDIUM 5 MEDIUM

    Other records, highest priority first

    • TI-2021-16263 Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR GuardPriority MEDIUM 45
    • TI-2021-16261 Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR GuardPriority MEDIUM 45
    • TI-2021-16260 Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR GuardPriority MEDIUM 45
    Show all 5 records →
  • Release ·

    QNAP Systems QVR Guard 2.1.3.0 (2021/12/06)

    4 records Highest priority Priority MEDIUM 4 MEDIUM

    Other records, highest priority first

    • TI-2021-16263 Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR GuardPriority MEDIUM 45
    • TI-2021-16261 Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR GuardPriority MEDIUM 45
    • TI-2021-16260 Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR GuardPriority MEDIUM 45
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-38691
  2. 2026-10-03 Alias added: GHSA-98m9-234r-rmcv

References

Advisory 1

  • TI-2021-16263 Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard CVSS 3.1CRITICAL 9.8
  • TI-2021-16261 Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard CVSS 3.1CRITICAL 9.8
  • TI-2021-16260 Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard CVSS 3.1CRITICAL 9.8
  • TI-2021-16254 Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences