CVE-2021-34345

CRITICAL

QNAP NVR Storage Expansion < 1.0.6 - Remote Code Execution via Stack Buffer Overflow

Title source: llm
STIX 2.1

Description

A stack buffer overflow vulnerability has been reported to affect QNAP device running NVR Storage Expansion. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of NVR Storage Expansion: NVR Storage Expansion 1.0.6 ( 2021/08/03 ) and later

References (1)

Core 1
Core References
Vendor Advisory x_refsource_misc
https://www.qnap.com/en/security-advisory/qsa-21-36

Scores

CVSS v3 9.8
EPSS 0.0121
EPSS Percentile 79.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (14)
qnap/ej1600_firmware < 1.0.6
qnap/tl-d1600s_firmware < 1.0.6
qnap/tl-d400s_firmware < 1.0.6
qnap/tl-d800c_firmware < 1.0.6
qnap/tl-d800s_firmware < 1.0.6
qnap/tl-r1200c-rp_firmware < 1.0.6
qnap/tl-r1200s-rp_firmware < 1.0.6
qnap/tl-r1220sep-rp_firmware < 1.0.6
qnap/tl-r1620sdc_firmware < 1.0.6
qnap/tl-r1620sep-rp_firmware < 1.0.6
... and 4 more
Published Sep 10, 2021
Tracked Since Feb 18, 2026