What’s Vulnerable › Vulnerabilities

CVE-2021-38674: Reflected XSS Vulnerability in TFTP

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-01-07 · updated 2026-06-17
• Weakness: CWE-79

Description

A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QuTS hero h4.5.4.1771 build 20210825 and later QTS 4.5.4.1787 build 20210910 and later QuTScloud c4.5.7.1864 and later

Affected products

• QNAP QTS: before 4.5.4.1787 — fixed in 4.5.4.1787
• QNAP Systems Inc. QuTS hero: before h4.5.4.1771 — fixed in h4.5.4.1771
• QNAP Systems Inc. QuTScloud: before c4.5.7.1864 — fixed in c4.5.7.1864

How to fix

Upgrade to a fixed version: QNAP QTS 4.5.4.1787; QNAP Systems Inc. QuTS hero h4.5.4.1771; QNAP Systems Inc. QuTScloud c4.5.7.1864. Check the vendor advisory for mitigations.

References

• https://www.qnap.com/en/security-advisory/qsa-21-63
• https://www.qnap.com/en/security-advisory/qsa-21-63

Get alerted when CVE-2021-38674 or the next vulnerability affects your stack