CVE-2021-28798CWE-23CWE-284

Relative Path Traversal Vulnerability in QTS and QuTS hero

High · published May 21, 2021

CVSS v3.1
8.8
EPSS
1%
Percentile
60.5
In the wild
Unconfirmed
What it is

A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to modify files that impact system integrity. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.2.1630 Build 20210406 and later QTS 4.3.6.1663 Build 20210504 and later QTS 4.3.3.1624 Build 20210416 and later QuTS hero h4.5.2.1638 Build 20210414 and later QNAP NAS running QTS 4.5.3 are not affected.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00938 · 60.5th percentile
Weaknesses
CWE-23 · Relative Path Traversal; CWE-284 · Improper Access Control
Published
2021-05-21T03:00Z
EPSS history
Timeline
  • 21 MAY 03:00Z
    Relative Path Traversal Vulnerability in QTS and QuTS hero
    cvelistv5