QNAP QHora Command Injection Vulnerability Allowing Arbitrary Command Execution
Vulnerability
A command injection vulnerability exists in QNAP QHora routers running QuRouter versions 2.4.x and 2.5.x. This vulnerability allows an attacker with local network access and an administrator account to execute arbitrary commands on the device.
Impact
Exploitation of this vulnerability could lead to unauthorized command execution on the affected device.
Remediation
Users can update to QuRouter version 2.5.0.140 or later to address this vulnerability. Instructions for updating QuRouter are available on the QNAP website.
Added: Jun 6, 2025, 4:39 PM
Updated: Jun 6, 2025, 4:39 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
7.5exploitability
3.0remediation
7.7relevance
0.2threat
0.0urgency
2.9incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.