Critical severity · published Nov 13, 2021
CVE-2021-38684
A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Multimedia Console
9.8
CVSS
1.3%
EPSS
No
On KEV
Description
A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Multimedia Console. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Multimedia Console: Multimedia Console 1.4.3 ( 2021/10/05 ) and later Multimedia Console 1.5.3 ( 2021/10/05 ) and later
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
Multimedia Console · Qnap
before 1.4.3; 1.5.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-38684
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-38684
Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-21-45
More from Multimedia Console
9.8
CVE-2023-23369
An OS command injection vulnerability has been reported to affect several QNAP operating system versions
9.8
CVE-2023-23364
A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating systems
9.8
CVE-2020-36195
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on
6.1
CVE-2020-2493
This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code