CVE-2021-32530

{"id": "CVE-2021-32530", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-07-07T14:15:11.753", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-4886-d3b14-1.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}, {"url": "https://www.twcert.org.tw/tw/cp-132-4886-d3b14-1.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated attackers to execute arbitrary commands via status parameter. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0."}, {"lang": "es", "value": "La vulnerabilidad de inyecci\u00f3n de comandos en el sistema operativo en la funci\u00f3n Array de QSAN XEVO permite a los atacantes remotos no autentificados ejecutar comandos arbitrarios a trav\u00e9s del par\u00e1metro de estado. La referida vulnerabilidad ha sido resuelta con la versi\u00f3n actualizada de QSAN XEVO versi\u00f3n v2.1.0"}], "lastModified": "2024-11-21T06:07:12.623", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:qsan:xevo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F251BD73-7615-434A-8F11-FAE4EBE2BE9B", "versionEndIncluding": "1.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "twcert@cert.org.tw"}