CVE-2021-28802

A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.1.1540 build 20210107. QNAP Systems Inc. QuTS hero versions prior to h4.5.1.1582 build 20210217.

• CWE-78

• https://www.qnap.com/zh-tw/security-advisory/qsa-21-29Vendor Advisory
• https://www.qnap.com/zh-tw/security-advisory/qsa-21-29Vendor Advisory

Published

Jul 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-28796Increments Qiita::Markdown before 0.33.0 allows XSS in trans…6.1
• CVE-2021-28797A stack-based buffer overflow vulnerability has been reporte…9.8
• CVE-2021-28798A relative path traversal vulnerability has been reported to…7.5
• CVE-2021-28799An improper authorization vulnerability has been reported to…9.8
• CVE-2021-28800A command injection vulnerability has been reported to affec…9.8
• CVE-2021-28801An out-of-bounds read vulnerability has been reported to aff…7.5
• CVE-2021-28803This issue affects: QNAP Systems Inc. Q'center versions prio…5.4
• CVE-2021-28804A command injection vulnerabilities have been reported to af…9.8
• CVE-2021-28805Inclusion of sensitive information in the source code has be…5.5
• CVE-2021-28806A DOM-based XSS vulnerability has been reported to affect QN…5.4
• CVE-2021-28807A post-authentication reflected XSS vulnerability has been r…5.4
• CVE-2021-28809An improper access control vulnerability has been reported t…9.8