Qurouter EUVD-2025-208901

Real-world risk is moderate to high despite missing CVSS scoring and EPSS data. The attack vector is 'local' (requires administrator account access), which significantly restricts the threat pool compared to network-accessible vulnerabilities. However, the technical impact is severe: SQL injection combined with code execution means a compromised admin account can fully compromise the QuRouter device and potentially the networks it routes. The availability of a patch in version 2.6.2.007 and later indicates QNAP acknowledges this as a genuine security flaw. The barrier to exploitation (requiring admin credentials) means this is a privilege escalation / post-compromise vector rather than a primary attack entry point, reducing its SSVC severity compared to unauthenticated remote code execution flaws. Organizations with well-protected administrator accounts face lower immediate risk; those with weak admin credential hygiene face elevated risk.

An attacker who has obtained or compromised an administrator account on a QuRouter device (through credential theft, social engineering, or prior compromise) logs into the administrative interface and inputs specially crafted SQL injection payloads into configuration fields—such as firewall rules, user management, or system settings. The unvalidated input is passed directly into a backend SQL query, allowing the attacker to break out of the intended query context and execute arbitrary SQL commands or system commands, thereby gaining full code execution on the QuRouter appliance and potentially pivoting to connected networks.