CVE-2021-38685

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A command injection vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR FW 5.1.6 build 20211109 and later

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
QNAP Systems Inc.QVR>= unspecified, < QVR FW 5.1.6 build 20211109

References

Timeline

Published
Nov 26, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-386868.8An improper authentication vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability allows attackersCVE-2021-386879.8A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Surveillance Station. If exploited, this vulnerability alCVE-2021-386887.5An improper authentication vulnerability has been reported to affect Android App Qfile. If exploited, this vulnerability allows attackers toCVE-2021-386899.8A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnCVE-2021-38697.5corenlp is vulnerable to Improper Restriction of XML External Entity ReferenceCVE-2021-386909.8A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnCVE-2021-386919.8A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnCVE-2021-386929.8A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnCVE-2021-386935.3A path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance. If exploited, tCVE-2021-386947.5SoftVibe SARABAN for INFOMA 1.1 allows SQL Injection.CVE-2021-386955.4SoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting (XSS) that allows users to store scripts in certain fields (e.gCVE-2021-386967.5SoftVibe SARABAN for INFOMA 1.1 has Incorrect Access Control vulnerability, that allows attackers to access signature files on the applicati
CVE-2021-38685: Critical severity, CVSS 9.8 | Vulnix