CVE-2021-34345: Stack Based Overflow Vulnerability in NVR Storage Expansion

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-10 · updated 2026-06-17
Weakness: CWE-787

Description

A stack buffer overflow vulnerability has been reported to affect QNAP device running NVR Storage Expansion. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of NVR Storage Expansion: NVR Storage Expansion 1.0.6 ( 2021/08/03 ) and later

Affected products

QNAP Ej1600 Firmware: before 1.0.6 — fixed in 1.0.6
QNAP Tl-D1600S Firmware: before 1.0.6 — fixed in 1.0.6
QNAP Tl-D400S Firmware: before 1.0.6 — fixed in 1.0.6
QNAP Tl-D800C Firmware: before 1.0.6 — fixed in 1.0.6
QNAP Tl-D800S Firmware: before 1.0.6 — fixed in 1.0.6
QNAP Tl-R1200C-Rp Firmware: before 1.0.6 — fixed in 1.0.6
QNAP Tl-R1200S-Rp Firmware: before 1.0.6 — fixed in 1.0.6
QNAP Tl-R1220Sep-Rp Firmware: before 1.0.6 — fixed in 1.0.6
QNAP Tl-R1620Sdc Firmware: before 1.0.6 — fixed in 1.0.6
QNAP Tl-R1620Sep-Rp Firmware: before 1.0.6 — fixed in 1.0.6
QNAP Tl-R400S Firmware: before 1.0.6 — fixed in 1.0.6
QNAP Tr-002 Firmware: before 1.0.6 — fixed in 1.0.6
QNAP Tr-004 Firmware: before 1.0.6 — fixed in 1.0.6
QNAP Tr-004U Firmware: before 1.0.6 — fixed in 1.0.6

How to fix

Upgrade to a fixed version: QNAP Ej1600 Firmware 1.0.6; QNAP Tl-D1600S Firmware 1.0.6; QNAP Tl-D400S Firmware 1.0.6; QNAP Tl-D800C Firmware 1.0.6; QNAP Tl-D800S Firmware 1.0.6; QNAP Tl-R1200C-Rp Firmware 1.0.6; QNAP Tl-R1200S-Rp Firmware 1.0.6; QNAP Tl-R1220Sep-Rp Firmware 1.0.6; QNAP Tl-R1620Sdc Firmware 1.0.6; QNAP Tl-R1620Sep-Rp Firmware 1.0.6; QNAP Tl-R400S Firmware 1.0.6; QNAP Tr-002 Firmware 1.0.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-34345 or the next vulnerability affects your stack