CVE-2025-62845

Published: Mar 20, 2026Modified: Jun 17, 2026

5.6

Vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security@qnapsecurity.com.tw (Secondary)

Description

An improper neutralization of escape, meta, or control sequences vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to cause unexpected behavior. We have already fixed the vulnerability in the following version: QuRouter 2.6.3.009 and later

Affected (4)

Products: Qnap: Qurouter

Qnap

1 product

Qurouter

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Qnap Qurouter	Version 2.6.0.239 build_20250625
Qnap Qurouter	Version 2.6.0.688 build_20250818
Qnap Qurouter	Version 2.6.1.028 build_20251001
Qnap Qurouter	Version 2.6.2.007 build_20251027

Related CWEs

CWE-150

Improper Neutralization of Escape, Meta, or Control Sequences

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

References (1)

https://www.qnap.com/en/security-advisory/qsa-26-12

Source: security@qnapsecurity.com.tw

Vendor Advisory

Timeline

No history available yet.