CVE-2021-37216: QSAN Storage Manager - Reflected Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-02 · updated 2026-06-17
Weakness: CWE-79

Description

QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected XSS attacks to access and modify specific data.

Affected products

QSAN Xn8008T Firmware: 3.3.2
QSAN Xn8024R Firmware: 3.1.5

References

https://www.twcert.org.tw/tw/cp-132-4962-44cd2-1.html
https://www.twcert.org.tw/tw/cp-132-4962-44cd2-1.html

Get alerted when CVE-2021-37216 or the next vulnerability affects your stack