Which versions of Qurouter are affected by CVE-2025-62846?

QNAP QuRouter versions before 2.6.2.007 contain an SQL injection vulnerability that allows authenticated administrators to execute arbitrary code, creating insider threat and lateral movement risks…. A patch is available.

How to fix or mitigate CVE-2025-62846?

Within 24 hours: Identify all QNAP QuRouter deployments and confirm current firmware versions. Within 7 days: Upgrade all QuRouter instances to version 2.6.2.007 or later; if upgrades cannot be scheduled immediately, enforce strict access controls limiting administrator account usage and implement network segmentation isolating QuRouter management interfaces. Within 30 days: Complete firmware patching across all affected devices and conduct administrative credential audit to detect unauthorized access.

Qurouter CVE-2025-62846

Q: What is the CVSS score of CVE-2025-62846?

CVE-2025-62846 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-208901 HIGH

SQL Injection (CWE-89)

2026-03-20 qnap

SQLi Qurouter

7.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:19 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.6.2.007

EUVD ID Assigned

Mar 20, 2026 - 16:30 euvd

EUVD-2025-208901

Analysis Generated

Mar 20, 2026 - 16:30 vuln.today

CVE Published

Mar 20, 2026 - 16:21 nvd

HIGH 7.3

DescriptionCVE.org

An SQL injection vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following version: QuRouter 2.6.2.007 and later

AnalysisAI

An SQL injection vulnerability exists in QNAP QuRouter that allows authenticated local administrators to execute unauthorized code or commands through SQL injection techniques. The vulnerability affects QuRouter versions prior to 2.6.2.007, and exploitation requires an attacker to first obtain legitimate administrator credentials on the affected device. While no CVSS score or EPSS data is currently published, the SQL injection classification (CWE-89) combined with code execution impact represents a critical risk for compromised administrator accounts.

Technical ContextAI

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that user-supplied input is not properly sanitized before being incorporated into SQL queries within the QuRouter application. QuRouter is QNAP's network routing and gateway appliance software (identified via CPE cpe:2.3:a:qnap_systems_inc.:qurouter). The SQL injection flaw allows an authenticated administrator to manipulate SQL queries to execute arbitrary commands, likely through administrative interface parameters or configuration fields that interact with the underlying database without proper input validation or parameterized query usage.

RemediationAI

Immediately upgrade QuRouter to version 2.6.2.007 or later using QNAP's official firmware update mechanism (consult https://www.qnap.com/en/security-advisory/qsa-26-12 for download and installation instructions). Until patching is completed, enforce principle of least privilege by restricting administrator account access to trusted personnel only, disable unnecessary administrative interfaces, and monitor administrator account activity for suspicious SQL-like patterns or unusual command execution. Consider isolating QuRouter devices on a protected management network segment to limit the impact of potential administrator account compromise.