« Volver al listado

CVE-2021-32522

Estado: ModificadaCrítica (9.8)—

Improper restriction of excessive authentication attempts vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to discover users’ credentials and obtain access via a brute force attack. Suggest contacting with QSAN and refer to recommendations in QSAN Document.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Qsan — SanosQsan — Storage ManagerQsan — Xevo

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-32522",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "twcert@cert.org.tw",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "twcert@cert.org.tw",
      "affectedData": [
        {
          "vendor": "QSAN",
          "product": "Storage Manager",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "3.3.1"
            }
          ]
        },
        {
          "vendor": "QSAN",
          "product": "XEVO",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "1.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "QSAN",
          "product": "SANOS",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "2.0.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-07-07T14:15:11.207",
  "references": [
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-4878-0a279-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-4878-0a279-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "twcert@cert.org.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-307"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper restriction of excessive authentication attempts vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to discover users’ credentials and obtain access via a brute force attack. Suggest contacting with QSAN and refer to recommendations in QSAN Document."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de restricción inadecuada de intentos de autenticación excesivos en QSAN Storage Manager, XEVO, SANOS permite a los atacantes remotos descubrir las credenciales de los usuarios y obtener acceso mediante un ataque de fuerza bruta. Se sugiere contactar con QSAN y consultar las recomendaciones del documento de QSAN"
    }
  ],
  "lastModified": "2026-06-17T03:53:06.370",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qsan:sanos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8E6A6A45-8986-4A14-A493-4E3EE03D7996",
              "versionEndIncluding": "2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:qsan:storage_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CE2A478-5140-4734-B1BA-0AB2741ADBB4",
              "versionEndIncluding": "3.3.1"
            },
            {
              "criteria": "cpe:2.3:a:qsan:xevo:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8E07217C-F1F9-473A-9068-D1530EA30D21",
              "versionEndExcluding": "1.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "twcert@cert.org.tw"
}