CVE-2021-38684

CRITICAL

A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Multimedia Console. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already f...

Affects 1 product across 1 vendor.

BCS7.37
CVSS 3.19.8
EPSS1.3%
Percentile67th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-787: Out-of-Bounds Write

Software writes data past buffer boundaries, corrupting memory and potentially enabling code execution.

◆ SAGE Intelligence — CITED Relevance Research Team

A stack buffer overflow vulnerability in QNAP NAS running Multimedia Console allows attackers to execute arbitrary code.

BSID: BS-2021-GLOBAL-073376-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2021-38684?
A stack buffer overflow vulnerability in QNAP NAS running Multimedia Console allows attackers to execute arbitrary code.
What is the CVSS score for CVE-2021-38684?
CVE-2021-38684 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.3%.
Is CVE-2021-38684 actively exploited?
No confirmed active exploitation of CVE-2021-38684 as of 2026-05-30.
How do I remediate CVE-2021-38684?
Priority: IMMEDIATE. Advisory: https://www.qnap.com/en/security-advisory/qsa-21-45 PSIRT: [email protected]
What systems are affected by CVE-2021-38684?
CVE-2021-38684 affects: Qnap.
Vulnerability Details
CVE IDCVE-2021-38684
BSIDBS-2021-GLOBAL-073376-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2021-11-13
Last Modified2024-11-21
ICS Relevance70%
Weakness (CWE)
Out-of-Bounds Write
SourceNVD
Official Description

A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Multimedia Console. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Multimedia Console: Multimedia Console 1.4.3 ( 2021/10/05 ) and later Multimedia Console 1.5.3 ( 2021/10/05 ) and later

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability is due to improper bounds checking on user-supplied input, leading to a stack buffer overflow. Attackers can exploit this to execute arbitrary code with the privileges of the Multimedia Console service.

Exploitation Likelihood: HIGH

Affected Products
VendorProductFixed Version
Qnap Multimedia Console —
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: July 2026 | Threat Age: 1715 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
SAGE Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashd3ff8d0191fab7aa32cf421834a9aa95800a8a5bdf14ff6a51bc61f91d068ae2b16f3a448b222fedc0a1bed323cc10caea1b1d2d7a95607dfd8cb4c755b41490
Related CVEs affecting Qnap
CVE-2017-7876 10.0 This command injection vulnerability in QTS allows attackers to run arbitrary... CVE-2024-32766 10.0 An OS command injection vulnerability has been reported to affect several QNA... CVE-2024-32764 9.9 A missing authentication for critical function vulnerability has been reporte... CVE-2017-13071 9.8 QNAP has already patched this vulnerability. This security concern allows a r... CVE-2021-38687 9.8 A stack buffer overflow vulnerability has been reported to affect QNAP NAS ru...
View all Qnap CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →