CVE-2021-32519: QSAN Storage Manager, XEVO, SANOS - Use of Password Hash With Insufficient Computational Effort

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-07-07 · updated 2026-06-17
Weakness: CWE-916

Description

Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to recover the plain-text password by brute-forcing the MD5 hash. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.2, QSAN XEVO v2.1.0, and QSAN SANOS v2.1.0.

Affected products

QSAN SANOS: before 2.1.0 — fixed in 2.1.0
QSAN Storage Manager: before 3.3.2 — fixed in 3.3.2
QSAN XEVO: before 2.1.0 — fixed in 2.1.0

How to fix

Upgrade to a fixed version: QSAN SANOS 2.1.0; QSAN Storage Manager 3.3.2; QSAN XEVO 2.1.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-32519 or the next vulnerability affects your stack