CVE-2021-47816

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Thecus N4800Eco NAS Server Control Panel contains a command injection vulnerability that allows authenticated attackers to execute arbitrary system commands through user management endpoints. Attackers can inject commands via username and batch user creation parameters to execute shell commands with administrative privileges.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jan 16, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2021

CVE-2021-478175.4OpenEMR 5.0.2.1 contains a cross-site scripting vulnerability in user profile parameters that authenticated attackers can chain with a file CVE-2021-478187.5DupTerminator 1.4.5639.37199 contains a denial of service vulnerability that allows attackers to crash the application by inputting a long c CVE-2021-478199.8ProjeQtOr Project Management 9.1.4 contains a file upload vulnerability that allows guest users to upload malicious PHP files with arbitrary CVE-2021-478205.3Ubee EVW327 contains a cross-site request forgery vulnerability that allows attackers to enable remote access without user interaction. Atta CVE-2021-478217.5RarmaRadio 2.72.8 contains a denial of service vulnerability that allows attackers to crash the application by overflowing network configura CVE-2021-478227.8DiskBoss Service 12.2.18 contains an unquoted service path vulnerability in its binary path configuration that allows local attackers to exe CVE-2021-478237.8Acer ePowerSvc 6.0.3008.0 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated CVE-2021-478247.5iDailyDiary 4.30 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the preferences ta CVE-2021-478257.8Acer Updater Service 1.2.3500.0 contains an unquoted service path vulnerability that allows local users to execute code with elevated system CVE-2021-478267.8Acer Backup Manager 3.0.0.99 contains an unquoted service path vulnerability in the NTI IScheduleSvc service that allows local users to pote CVE-2021-478277.5WebSSH for iOS 14.16.10 contains a denial of service vulnerability in the mashREPL tool that allows attackers to crash the application by pa CVE-2021-478287.8BOOTP Turbo 2.0.0.1253 contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unquo