CVE-2021-44051

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 5.0.0.1986 build 20220324 and later

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published: May 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-440528.1An improper link resolution before file access ('Link Following') vulnerability has been reported to affect QNAP device running QuTScloud, Q CVE-2021-440536.1A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud. If exploited, this CVE-2021-440546.1An open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS. If exploited, this vulnerabilit CVE-2021-440559.8An missing authorization vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allow CVE-2021-440569.8An improper authentication vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability all CVE-2021-440579.8An improper authentication vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability all CVE-2021-44067.2An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITS CVE-2021-44074.3The Custom Banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.2 This is due to m CVE-2021-440764.8An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with CVE-2021-440779.8Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to un CVE-2021-440788.1An issue was discovered in split_region in uc.c in Unicorn Engine before 2.0.0-rc5. It allows local attackers to escape the sandbox. An atta CVE-2021-440799.8In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially