CVE-2021-34351

CVE-2021-34351 is a critical command injection vulnerability affecting QNAP QVR, a video surveillance solution. This flaw allows unauthenticated remote attackers to execute arbitrary commands on affected devices. With a CVSS score of 9.8 (Critical), exploitation is straightforward, requiring no user interaction or complex attack conditions, and can lead to complete compromise of confidentiality, integrity, and availability. While not currently listed in CISA's KEV catalog, there is no public exploit code available, and community discussion and media coverage indicate awareness but not active widespread exploitation. QNAP has released patches in QVR 5.1.5 build 20210803 and later.