CVE-2021-32532
CVE-2021-32532 is a high-severity vulnerability in Qsan Xevo with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-22.
Key facts
- Severity: High (CVSS 3.x base score 7.5)
- CVSS v2: 5.0
- EPSS exploit prediction: 2% (76th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-22
- Affected product: Qsan Xevo
- Published:
- Last modified:
Description
Path traversal vulnerability in back-end analysis function in QSAN XEVO allows remote attackers to download arbitrary files without permissions. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0.
Frequently asked questions
- What is CVE-2021-32532?
- Path traversal vulnerability in back-end analysis function in QSAN XEVO allows remote attackers to download arbitrary files without permissions. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0.
- How severe is CVE-2021-32532?
- CVE-2021-32532 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2021-32532 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (76th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2021-32532?
- CVE-2021-32532 affects Qsan Xevo. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2021-32532?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2021-32532 published?
- CVE-2021-32532 was published on 2021-07-07 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:qsan:xevo:*:*:*:*:*:*:*:*
More vulnerabilities in Qsan Xevo
- CVE-2021-32531 — Critical (CVSS 9.8): OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary commands…
- CVE-2021-32530 — Critical (CVSS 9.8): OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated attackers to execute…
- CVE-2021-32529 — Critical (CVSS 9.8): Command injection vulnerability in QSAN XEVO, SANOS allows remote unauthenticated attackers to execute arbitrary…
- CVE-2021-32522 — Critical (CVSS 9.8): Improper restriction of excessive authentication attempts vulnerability in QSAN Storage Manager, XEVO, SANOS allows…
- CVE-2021-32519 — Critical (CVSS 9.8): Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows…
- CVE-2021-32521 — High (CVSS 7.3): Use of MAC address as an authenticated password in QSAN Storage Manager, XEVO, SANOS allows local attackers to escalate…
All CVEs affecting Qsan Xevo →
Other CWE-22 (Path Traversal) vulnerabilities
- CVE-2026-55393 — Critical (CVSS 10.0): Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9…
- CVE-2026-97163 — Critical (CVSS 10.0): Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
- CVE-2026-80155 — Critical (CVSS 10.0): Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1,…
- CVE-2026-70200 — Critical (CVSS 10.0): Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an…
- CVE-2026-85706 — Critical (CVSS 10.0): GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9,…
- CVE-2026-76606 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2.