JVNDB-2021-005998

[Japanese]
JVNDB-2021-005998
Multiple vulnerabilities in QNAP VioStar NVR
Overview
VioStar series NVR provided by QNAP Systems contains multiple vulnerabilities listed below. * Command injection (CWE-77) - CVE-2021-38685 * Improper authentication (CWE-287) - CVE-2021-38686
CVSS Severity (What is CVSS?)
CVSS V3 Severity: Base Metrics 9.8 (Critical) [Other] Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality Impact: High Integrity Impact: High Availability Impact: High CVSS V2 Severity: Base Metrics 7.5 (High) [NVD Score] Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial The above CVSS base scores have been assigned for CVE-2021-38685
CVSS V3 Severity: Base Metrics:9.8 (Critical) [Other] Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality Impact: High Integrity Impact: High Availability Impact: High The above CVSS base scores have been assigned for CVE-2021-38686
Affected Products

QNAP Systems VioStor NVR firmware

Impact
* An arbitrary command may be executed by a remote attacker. - CVE-2021-38685 * A remote attacker can login to the vulnerable system. - CVE-2021-38686
Solution
[Update the firmware] Apply the appropriate firmware update according to the information provided by the developer. The developer has released fixed version below. * QVR 5.1.6 build 20211109
Vendor Information
QNAP Systems Security Advisory : QSA-21-51 Security Advisory : QSA-21-52
CWE (What is CWE?)
Improper Authentication(CWE-287) [Other] Command Injection(CWE-77) [Other]
CVE (What is CVE?)
CVE-2021-38685 CVE-2021-38686
References
JVN : JVNVU#95429813 National Vulnerability Database (NVD) : CVE-2021-38685 National Vulnerability Database (NVD) : CVE-2021-38686
Revision History
[2013/12/24] Web page was published


Date Public	2021/12/22
Date First Published	2021/12/24
Date Last Updated	2021/12/24

Multiple vulnerabilities in QNAP VioStar NVR