CVE-2024-50390highCWE-1188CWE-78

CVE-2024-50390: high-severity vulnerability in QNAP Systems Inc. QuRouter

QHora

Published

Follow this CVE+ Monitor QuRouter

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.7epss 1.1%
In short

QHora has a flaw that allows attackers to run unauthorized commands on the system by sending specially crafted input. This is a serious security issue because it gives attackers complete control over the affected device.

Technical detail

A command injection vulnerability (CWE-78) in QHora allows remote attackers to execute arbitrary OS commands through unsanitized user input passed to system execution functions. The vulnerability requires network access but no authentication; successful exploitation grants full system-level command execution. Fixed in QuRouter 2.4.5.032 and later.

Summary generated and translated by AI from the official description.
A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuRouter 2.4.5.032 and later
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
QNAP Systems Inc. · QuRouter
Related CVEs — QNAP Systems Inc. QuRouter

In the same product, most dangerous first.

CVE-2024-48860CRITICALQHoraEPSS 1.5%CVE-2024-53700MEDIUMQHoraEPSS 1.2%CVE-2025-29887HIGHQuRouter 2.5EPSS 0.8%CVE-2024-50389CRITICALQuRouterEPSS 0.8%CVE-2024-48861HIGHQHoraEPSS 0.8%CVE-2024-13087LOWQHoraEPSS 0.7%