CVE-2021-32513

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

QsanTorture in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and execute arbitrary commands. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
QSANStorage Manager>= unspecified, <= 3.3.1

References

Timeline

Published
Jul 7, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-325147.5Improper access control vulnerability in FirmwareUpgrade in QSAN Storage Manager allows remote attackers to reboot and discontinue the devicCVE-2021-325155.3Directory listing vulnerability in share_link in QSAN Storage Manager allows attackers to list arbitrary directories and further access credCVE-2021-325167.5Path traversal vulnerability in share_link in QSAN Storage Manager allows remote attackers to download arbitrary files. The referred vulneraCVE-2021-325177.5Improper access control vulnerability in share_link in QSAN Storage Manager allows remote attackers to download arbitrary files using particCVE-2021-325187.5A vulnerability in share_link in QSAN Storage Manager allows remote attackers to create a symbolic link then access arbitrary files. The refCVE-2021-325197.5Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to reCVE-2021-32527.5KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from theCVE-2021-325209.8Use of hard-coded cryptographic key vulnerability in QSAN Storage Manager allows attackers to obtain users’ credentials and related permissiCVE-2021-325219.8Use of MAC address as an authenticated password in QSAN Storage Manager, XEVO, SANOS allows local attackers to escalate privileges. Suggest CVE-2021-325229.8Improper restriction of excessive authentication attempts vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to discCVE-2021-325237.2Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitraCVE-2021-325247.2Command injection vulnerability in QSAN Storage Manager allows remote privileged users to execute arbitrary commands. Suggest contacting wit
CVE-2021-32513: Critical severity, CVSS 9.8 | Vulnix