QSAN vulnerabilities

Latest high and critical flaws

• CVE-2021-32535 The vulnerability of hard-coded default credentials in QSAN SANOS allows unauthenticated remote attackers to obtain administrator’s permission and execute arbitCritical 9.8 · Jul 7, 2021
• CVE-2021-32534 QSAN SANOS factory reset function does not filter special parameters.Critical 9.8 · Jul 7, 2021
• CVE-2021-32533 The QSAN SANOS setting page does not filter special parameters.Critical 9.8 · Jul 7, 2021
• CVE-2021-32532 Path traversal vulnerability in back-end analysis function in QSAN XEVO allows remote attackers to download arbitrary files without permissions.High 7.5 · Jul 7, 2021
• CVE-2021-32531 OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary commands without permissions.Critical 9.8 · Jul 7, 2021
• CVE-2021-32530 OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated attackers to execute arbitrary commands via status parameter.Critical 9.8 · Jul 7, 2021
• CVE-2021-32529 Command injection vulnerability in QSAN XEVO, SANOS allows remote unauthenticated attackers to execute arbitrary commands.Critical 9.8 · Jul 7, 2021
• CVE-2021-32527 Path traversal vulnerability in QSAN Storage Manager allows remote unauthenticated attackers to download arbitrary files thru injecting file path in download fuHigh 7.5 · Jul 7, 2021
• CVE-2021-32525 The same hard-coded password in QSAN Storage Manager's in the firmware allows remote attackers to access the control interface with the administrator’s credentiCritical 9.1 · Jul 7, 2021
• CVE-2021-32524 Command injection vulnerability in QSAN Storage Manager allows remote privileged users to execute arbitrary commands.Critical 9.1 · Jul 7, 2021
• CVE-2021-32523 Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitrary commands.Critical 9.1 · Jul 7, 2021
• CVE-2021-32522 Improper restriction of excessive authentication attempts vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to discover users’ credentiCritical 9.8 · Jul 7, 2021
• CVE-2021-32521 Use of MAC address as an authenticated password in QSAN Storage Manager, XEVO, SANOS allows local attackers to escalate privileges.High 7.3 · Jul 7, 2021
• CVE-2021-32520 Use of hard-coded cryptographic key vulnerability in QSAN Storage Manager allows attackers to obtain users’ credentials and related permissions.Critical 9.8 · Jul 7, 2021
• CVE-2021-32519 Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to recover the plain-textCritical 9.8 · Jul 7, 2021
• CVE-2021-32518 A vulnerability in share_link in QSAN Storage Manager allows remote attackers to create a symbolic link then access arbitrary files.High 7.5 · Jul 7, 2021
• CVE-2021-32517 Improper access control vulnerability in share_link in QSAN Storage Manager allows remote attackers to download arbitrary files using particular parameter in doHigh 7.5 · Jul 7, 2021
• CVE-2021-32516 Path traversal vulnerability in share_link in QSAN Storage Manager allows remote attackers to download arbitrary files.High 7.5 · Jul 7, 2021
• CVE-2021-32514 Improper access control vulnerability in FirmwareUpgrade in QSAN Storage Manager allows remote attackers to reboot and discontinue the device.High 7.5 · Jul 7, 2021
• CVE-2021-32513 QsanTorture in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and execute arbitrary comCritical 9.8 · Jul 7, 2021
• CVE-2021-32512 QuickInstall in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and execute arbitrary coCritical 9.8 · Jul 7, 2021