{"id":"CVE-2021-32531","aliases":["EUVD-2021-19377","GHSA-qrmg-m8r6-9cvr"],"status":"published","title":"QSAN XEVO - Command Injection Following via Init function","description":"OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.02058,"percentile":0.81557,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2021-07-07T14:12:19Z","modified":"2026-06-17T03:53:07Z","products":[{"vendor":"qsan","product":"xevo"}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-4887-ee5e3-1.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32531"},{"url":"https://github.com/advisories/GHSA-qrmg-m8r6-9cvr"}],"sources":{"cve":[{"id":"CVE-2021-32531","title":"QSAN XEVO - Command Injection Following via Init function","description":"OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0.","status":"published","published":"2021-07-07T14:12:19.152Z","modified":"2024-09-17T02:06:13.328Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:33:07.014772Z"}],"euvd":[{"id":"EUVD-2021-19377","description":"OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0.","status":"published","published":"2021-07-07T14:12:19Z","modified":"2024-09-17T02:06:13Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:28:43.867146Z"}],"ghsa":[{"id":"GHSA-qrmg-m8r6-9cvr","title":"OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to...","description":"OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary commands without permissions.","status":"published","published":"2022-05-24T19:07:01Z","modified":"2023-01-30T05:00:37Z","cwes":["CWE-78"],"updated_at":"2026-11-02T14:46:14.46933Z"}],"nvd":[{"id":"CVE-2021-32531","description":"OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0.","status":"published","published":"2021-07-07T14:15:11.823Z","modified":"2026-06-17T03:53:07.357Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:06:55.259633Z"}]}}