CVE-2025-62846 is a high-severity SQL injection vulnerability (CWE-89) affecting QHora devices running QRouter versions prior to 2.6.2.007. With a CVSSv4 score of 7.3, this flaw allows a local attacker who has already gained administrator access to execute unauthorized code or commands, leading to high impact on system confidentiality, integrity, and availability. Although the vulnerability was demonstrated at Pwn2Own Ireland 2025, there is currently no public exploit code available, and it is not known to be actively exploited in the wild. Organizations are strongly advised to update QHora devices to QRouter 2.6.2.007 or later to remediate this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.6.0.239CPE matchmatch criteria | cpe:2.3:o:qnap:qurouter:2.6.0.239:build_20250625:*:*:*:*:*:* | ||
2.6.0.688CPE matchmatch criteria | cpe:2.3:o:qnap:qurouter:2.6.0.688:build_20250818:*:*:*:*:*:* | ||
2.6.1.028CPE matchmatch criteria | cpe:2.3:o:qnap:qurouter:2.6.1.028:build_20251001:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.