CVE-2021-34351

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Sep 27, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-343529.8A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote aCVE-2021-343545.4A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability aCVE-2021-343555.4A cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, this vulnerability alloCVE-2021-343565.4A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability aCVE-2021-343576.1A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QmailAgent. If exploited, this vulnerability alloCVE-2021-343588.8We have already fixed this vulnerability in the following versions of QmailAgent: QmailAgent 3.0.2 ( 2021/08/25 ) and laterCVE-2021-343595.4A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability alCVE-2021-34366.5BT: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is known. Zephyr versions >=CVE-2021-343608.8A cross-site request forgery (CSRF) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerabiCVE-2021-343616.1A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability alCVE-2021-343627.2A command injection vulnerability has been reported to affect QNAP device running Media Streaming add-on. If exploited, this vulnerability aCVE-2021-343639.1The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive
CVE-2021-34351: Critical severity, CVSS 9.8 | Vulnix