Thecus N4800Eco NAS Server Control Panel contains a command injection vulnerability that allows authenticated attackers to execute arbitrary system commands thr…

CVE-2021-47816 is a command injection vulnerability in Thecus N4800Eco NAS Server Control Panel that allows authenticated attackers to execute arbitrary system commands through user management endpoints. The vulnerability can be exploited by injecting commands via username and batch user creation parameters. Successful exploitation grants attackers the ability to execute shell commands with administrative privileges. This affects the Thecus N4800Eco Network Attached Storage device's web-based control panel. The vulnerability requires authentication but provides significant privilege escalation capabilities once exploited.