CVE-2021-28797CWE-121

Stack Buffer Overflow in Surveillance Station

Critical · published April 14, 2021

CVSS v3.1
9.8
EPSS
6%
Percentile
93.2
In the wild
Unconfirmed
What it is

🚨 A stack-based buffer overflow in QNAP NAS Surveillance Station could let attackers take control of your device! 🔥 Think of this vulnerability as a well-meaning but careless chef who leaves the kitchen door wide open — any unauthorized guest can just stroll in and wreak havoc in your kitchen! If exploited, attackers could execute arbitrary code on your NAS, potentially leading to data breaches or complete system takeover. This could be absolutely devastating, as your sensitive information is left vulnerable and your surveillance system could be hijacked!

Put simply

Think of this vulnerability as a well-meaning but careless chef who leaves the kitchen door wide open — any unauthorized guest can just stroll in and wreak havoc in your kitchen! The vulnerability arises from insufficient bounds checking during operation, allowing attackers to overflow the stack and run malicious code on the affected devices.

What to do

If exploited, attackers could execute arbitrary code on your NAS, potentially leading to data breaches or complete system takeover. This could be absolutely devastating, as your sensitive information is left vulnerable and your surveillance system could be hijacked! Update your Surveillance Station to version 5.1.5.4.3 (or later) for ARM and x86 CPU NAS (64bit OS) and version 5.1.5.3.3 (or later) for ARM and x86 CPU NAS (32bit OS) immediately. Don't wait — patching is key to securing your data! You've got this! Following these steps will help keep your NAS secure and your surveillance systems safe. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.05909 · 93.2th percentile
Weakness
CWE-121 · Stack-based Buffer Overflow
Published
2021-04-14T08:50Z
EPSS history
Timeline
  • 14 APR 08:50Z
    Stack Buffer Overflow in Surveillance Station
    cvelistv5