7.3 HighCWE-89
CVE-2025-62846
QuRouter
QNAP Systems Inc.QuRouter
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
0.2%probability of exploitation in the next 30 days
Higher than 11% of scored CVEs
SeverityCVSS
7.3High
Description NVD
An SQL injection vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: QuRouter 2.6.2.007 and later
Coverage 2 articles · 2 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Mon 23 Mar · 11:36 UTC | SecurityWeek | QNAP Patches Four Vulnerabilities Exploited at Pwn2Own |
| Mon 23 Mar · 21:53 UTC | Security Affairs | QNAP fixed four vulnerabilities demonstrated at Pwn2Own Ireland 2025 |
- QNAP fixed four vulnerabilities demonstrated at Pwn2Own Ireland 2025Security Affairs · mentions it in passing
- QNAP Patches Four Vulnerabilities Exploited at Pwn2OwnSecurityWeek · first in our coverage · mentions it in passing