What’s Vulnerable › Vulnerabilities

CVE-2021-34362: Command Injection Vulnerability in Media Streaming Add-on

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-10-22 · updated 2026-06-17
• Weakness: CWE-78

Description

A command injection vulnerability has been reported to affect QNAP device running Media Streaming add-on. If exploited, this vulnerability allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of Media Streaming add-on: QTS 5.0.0: Media Streaming add-on 500.0.0.3 ( 2021/08/20 ) and later QTS 4.5.4: Media Streaming add-on 500.0.0.3 ( 2021/08/20 ) and later QTS 4.3.6: Media Streaming add-on 430.1.8.12 ( 2021/08/20 ) and later QTS 4.3.3: Media Streaming add-on 430.1.8.12 ( 2021/09/29 ) and later QuTS-Hero 5.0.0: Media Streaming add-on 500.0.0.3 ( 2021/08/20 ) and later

Affected products

• QNAP Systems Inc. Media Streaming add-on: before 500.0.0.3; before 430.1.8.12 — fixed in 430.1.8.12, 500.0.0.3

How to fix

Upgrade to a fixed version: QNAP Systems Inc. Media Streaming add-on 430.1.8.12, 500.0.0.3. Check the vendor advisory for mitigations.

References

• https://www.qnap.com/en/security-advisory/qsa-21-44
• https://www.qnap.com/en/security-advisory/qsa-21-44

Get alerted when CVE-2021-34362 or the next vulnerability affects your stack