{"id":"CVE-2021-32530","aliases":["EUVD-2021-19376","GHSA-whm9-h873-f559"],"status":"published","title":"QSAN XEVO - Command Injection Following via Array function","description":"OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated attackers to execute arbitrary commands via status parameter. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.02309,"percentile":0.83599,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2021-07-07T14:12:17Z","modified":"2026-06-17T03:53:07Z","products":[{"vendor":"qsan","product":"xevo"}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-4886-d3b14-1.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32530"},{"url":"https://github.com/advisories/GHSA-whm9-h873-f559"}],"sources":{"cve":[{"id":"CVE-2021-32530","title":"QSAN XEVO - Command Injection Following via Array function","description":"OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated attackers to execute arbitrary commands via status parameter. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0.","status":"published","published":"2021-07-07T14:12:17.596Z","modified":"2024-09-16T22:02:09.065Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:33:07.014772Z"}],"euvd":[{"id":"EUVD-2021-19376","description":"OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated attackers to execute arbitrary commands via status parameter. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0.","status":"published","published":"2021-07-07T14:12:17Z","modified":"2024-09-16T22:02:09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:55:06.207566Z"}],"ghsa":[{"id":"GHSA-whm9-h873-f559","title":"OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated...","description":"OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated attackers to execute arbitrary commands via status parameter.","status":"published","published":"2022-05-24T19:07:01Z","modified":"2023-01-30T05:00:37Z","cwes":["CWE-78"],"updated_at":"2026-11-02T14:46:14.46933Z"}],"nvd":[{"id":"CVE-2021-32530","description":"OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated attackers to execute arbitrary commands via status parameter. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0.","status":"published","published":"2021-07-07T14:15:11.753Z","modified":"2026-06-17T03:53:07.25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:06:55.259633Z"}]}}