CVE-2021-32522

Published: Jul 7, 2021Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: twcert@cert.org.tw (Secondary)

Description

Improper restriction of excessive authentication attempts vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to discover users’ credentials and obtain access via a brute force attack. Suggest contacting with QSAN and refer to recommendations in QSAN Document.

Affected (3)

Products: Qsan: Sanos, Storage Manager, Xevo

3 products

Storage Manager

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Qsan Sanos	Up to 2.0.0
Qsan Storage Manager	Up to 3.3.1
Qsan Xevo	Before 1.2.0

Related CWEs

Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (2)

https://www.twcert.org.tw/tw/cp-132-4878-0a279-1.html

Source: twcert@cert.org.tw

Third Party Advisory

https://www.twcert.org.tw/tw/cp-132-4878-0a279-1.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.