CVE-2021-32522

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper restriction of excessive authentication attempts vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to discover users’ credentials and obtain access via a brute force attack. Suggest contacting with QSAN and refer to recommendations in QSAN Document.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-307

Affected software

No affected versions have been published.

Timeline

Published: Jul 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-325237.2Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitra CVE-2021-325247.2Command injection vulnerability in QSAN Storage Manager allows remote privileged users to execute arbitrary commands. Suggest contacting wit CVE-2021-325257.2The same hard-coded password in QSAN Storage Manager's in the firmware allows remote attackers to access the control interface with the admi CVE-2021-325266.5Incorrect permission assignment for critical resource vulnerability in QSAN Storage Manager allows authenticated remote attackers to access CVE-2021-325277.5Path traversal vulnerability in QSAN Storage Manager allows remote unauthenticated attackers to download arbitrary files thru injecting file CVE-2021-325285.3Observable behavioral discrepancy vulnerability in QSAN Storage Manager allows remote attackers to obtain the system information without per CVE-2021-325299.8Command injection vulnerability in QSAN XEVO, SANOS allows remote unauthenticated attackers to execute arbitrary commands. Suggest contactin CVE-2021-325309.8OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated attackers to execute arbitrary commands via CVE-2021-325319.8OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary commands without permissions. CVE-2021-325327.5Path traversal vulnerability in back-end analysis function in QSAN XEVO allows remote attackers to download arbitrary files without permissi CVE-2021-325339.8The QSAN SANOS setting page does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary CVE-2021-325349.8QSAN SANOS factory reset function does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbi