QNAP QHora SQL Injection Vulnerability Allowing Unauthorized Code Execution

A SQL injection vulnerability has been identified in QNAP's QuRouter version 2.6.x. This vulnerability allows local attackers with administrator privileges to execute unauthorized code or commands. The issue arises from improper validation of user input, which can be exploited to manipulate SQL queries and execute malicious payloads.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution on the affected device.

Remediation

Users can update to QuRouter version 2.6.3.009 or later to address this vulnerability. Instructions for updating QuRouter are available on the QNAP website.