QNAP Qcalagent vulnerabilities

3 CVEs affecting QNAP Qcalagent, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-41289, published 2024-01-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-41289, published 2024-01-05. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. An OS command injection vulnerability has been reported to affect QcalAgent. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed…
CVE-2021-38677, published 2022-01-14. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QcalAgent. If exploited, this vulnerability allows remote attackers to inject malicious code. We have…
CVE-2021-38678, published 2022-01-14. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. An open redirect vulnerability has been reported to affect QNAP device running QcalAgent. If exploited, this vulnerability allows attackers to redirect users to an untrusted page that contains…