CVE-2025-62845

MEDIUM

QNAP QuRouter < 2.6.3.009 - Local Admin Control Sequence Injection

Title source: manual
STIX 2.1

Description

An improper neutralization of escape, meta, or control sequences vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to cause unexpected behavior. We have already fixed the vulnerability in the following version: QuRouter 2.6.3.009 and later

References (1)

Core 1

Scores

CVSS v3 6.7
EPSS 0.0002
EPSS Percentile 4.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-150
Status published
Products (5)
qnap/qurouter 2.6.0.239 build_20250625
qnap/qurouter 2.6.0.688 build_20250818
qnap/qurouter 2.6.1.028 build_20251001
qnap/qurouter 2.6.2.007 build_20251027
QNAP Systems Inc./QuRouter 2.6.x - 2.6.3.009
Published Mar 20, 2026
Tracked Since Mar 20, 2026