CVEvulnerability
CVE-2021-47816
5.3 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2026-01-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 5.3 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-78
Description
Thecus N4800Eco NAS Server Control Panel contains a command injection vulnerability that allows authenticated attackers to execute arbitrary system commands through user management endpoints. Attackers can inject commands via username and batch user creation parameters to execute shell commands with administrative privileges.
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- http://www.thecus.com/ www.thecus.com
- http://www.thecus.com/product.php?PROD_ID=83 www.thecus.com
- https://docs.unsafe-inline.com/0day/thecus-n4800eco-nas-server-control-panel-comand-injection docs.unsafe-inline.com
- https://www.exploit-db.com/exploits/49926 www.exploit-db.com
- https://www.vulncheck.com/advisories/thecus-neco-nas-server-control-panel-command-injection www.vulncheck.com