CVE-2021-32519

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to recover the plain-text password by brute-forcing the MD5 hash. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.2, QSAN XEVO v2.1.0, and QSAN SANOS v2.1.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-916

Affected software

VendorProductVersions
QSANStorage Manager>= unspecified, <= 3.3.1
QSANXEVO>= unspecified, < 1.2.0
QSANSANOS2.0.0

References

Timeline

Published
Jul 7, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-32527.5KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from theCVE-2021-325209.8Use of hard-coded cryptographic key vulnerability in QSAN Storage Manager allows attackers to obtain users’ credentials and related permissiCVE-2021-325219.8Use of MAC address as an authenticated password in QSAN Storage Manager, XEVO, SANOS allows local attackers to escalate privileges. Suggest CVE-2021-325229.8Improper restriction of excessive authentication attempts vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to discCVE-2021-325237.2Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitraCVE-2021-325247.2Command injection vulnerability in QSAN Storage Manager allows remote privileged users to execute arbitrary commands. Suggest contacting witCVE-2021-325257.2The same hard-coded password in QSAN Storage Manager's in the firmware allows remote attackers to access the control interface with the admiCVE-2021-325266.5Incorrect permission assignment for critical resource vulnerability in QSAN Storage Manager allows authenticated remote attackers to access CVE-2021-325277.5Path traversal vulnerability in QSAN Storage Manager allows remote unauthenticated attackers to download arbitrary files thru injecting fileCVE-2021-325285.3Observable behavioral discrepancy vulnerability in QSAN Storage Manager allows remote attackers to obtain the system information without perCVE-2021-325299.8Command injection vulnerability in QSAN XEVO, SANOS allows remote unauthenticated attackers to execute arbitrary commands. Suggest contactinCVE-2021-325309.8OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated attackers to execute arbitrary commands via
CVE-2021-32519: High severity, CVSS 7.5 | Vulnix