CVE-2021-28797

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3 (and later) for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS) Surveillance Station 5.1.5.3.3 (and later) for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS)

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Apr 14, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-287987.5A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allCVE-2021-287999.8An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerabCVE-2021-288009.8A command injection vulnerability has been reported to affect QNAP NAS running legacy versions of QTS. If exploited, this vulnerability alloCVE-2021-288017.5An out-of-bounds read vulnerability has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows aCVE-2021-288029.8A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to exeCVE-2021-288035.4This issue affects: QNAP Systems Inc. Q'center versions prior to 1.11.1004.CVE-2021-288049.8A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to exeCVE-2021-288055.5Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnCVE-2021-288065.4A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackCVE-2021-288075.4A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability alCVE-2021-288099.8An improper access control vulnerability has been reported to affect certain legacy versions of HBS 3. If exploited, this vulnerability alloCVE-2021-288107.5If exploited, this vulnerability allows an attacker to access resources which are not otherwise accessible without proper authentication. Ro
CVE-2021-28797: Critical severity, CVSS 9.8 | Vulnix