Critical severity · published Apr 14, 2021
CVE-2021-28797
A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station
9.8
CVSS
5.9%
EPSS
No
On KEV
Description
A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3 (and later) for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS) Surveillance Station 5.1.5.3.3 (and later) for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.9% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Surveillance Station · Qnap
before 5.1.5.3.3; 5.1.5.4.0 before 5.1.5.4.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-28797
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-28797
Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-21-07
More from Surveillance Station
9.8
CVE-2021-38687
A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Surveillance Station
9.8
CVE-2020-2501
A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station