CVE-2021-38684

HIGH

QNAP Multimedia Console < 1.4.3 - Remote Code Execution via Stack Buffer Overflow

Title source: llm
STIX 2.1

Description

A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Multimedia Console. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Multimedia Console: Multimedia Console 1.4.3 ( 2021/10/05 ) and later Multimedia Console 1.5.3 ( 2021/10/05 ) and later

References (1)

Core 1
Core References
Vendor Advisory x_refsource_misc
https://www.qnap.com/en/security-advisory/qsa-21-45

Scores

CVSS v3 8.1
EPSS 0.0081
EPSS Percentile 74.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (2)
qnap/multimedia_console 1.5.2
qnap/multimedia_console < 1.4.3
Published Nov 13, 2021
Tracked Since Feb 18, 2026