CVE-2024-21898

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Sep 6, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-218999.8An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerabilityCVE-2024-219006.5An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow aCVE-2024-219014.7A SQL injection vulnerability has been reported to affect myQNAPcloud. If exploited, the vulnerability could allow authenticated administratCVE-2024-219028.1An incorrect permission assignment for critical resource vulnerability has been reported to affect several QNAP operating system versions. ICVE-2024-219034.7An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability coCVE-2024-219046.5A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allCVE-2024-219058.2An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerCVE-2024-219064.7An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability coCVE-2024-219077.5Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to tCVE-2024-219086.1TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could inseCVE-2024-219097.5PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability. An attacker may trigger the denial of serviceCVE-2024-21915.3An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and
CVE-2024-21898: High severity, CVSS 8.8 | Vulnix