title: Command Injection Vulnerability in VioStor
description: A command injection vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR FW 5.1.6 build 20211109 and later
problem types: CWE-78 OS Command Injection
affected:
{
product: QVR
vendor: QNAP Systems Inc.
versions:
lessThan: QVR FW 5.1.6 build 20211109, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: We have already fixed this vulnerability in the following versions of QVR:
QVR FW 5.1.6 build 20211109 and later