Read the docs
TI-2024-12135 Aliases CVE-2024-13087GHSA-7c8j-xg5r-5j56

OS command injection in QNAP QuRouter

Priority LOW 13CWE-78Published · Updated

Key facts

Attack vector
Physical
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A command injection vulnerability has been reported to affect QHora. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuRouter 2.4.6.028 and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00656 51st percentileScored 2026-11-07
Fix Fixed QuRouter (QNAP Systems Inc.): 2.4.6.028

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQuRouter2.4.x to before 2.4.6.0282.4.6.028Patch availableCNA
  • QuRouter VendorQNAP Affected 2.4.x to before 2.4.6.028 Fixed in 2.4.6.028 Patch available CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qurouter:2.4.0.190:build_20240522:*:*:*:*:*:*2.4.0.190 build_20240522VulnerableQNAP
cpe:2.3:o:qnap:qurouter:2.4.1.172:build_20240606:*:*:*:*:*:*2.4.1.172 build_20240606VulnerableQNAP
cpe:2.3:o:qnap:qurouter:2.4.1.634:build_20240710:*:*:*:*:*:*2.4.1.634 build_20240710VulnerableQNAP
cpe:2.3:o:qnap:qurouter:2.4.2.317:build_20240903:*:*:*:*:*:*2.4.2.317 build_20240903VulnerableQNAP
cpe:2.3:o:qnap:qurouter:2.4.2.538:build_20240923:*:*:*:*:*:*2.4.2.538 build_20240923VulnerableQNAP
cpe:2.3:o:qnap:qurouter:2.4.3.103:build_20241011:*:*:*:*:*:*2.4.3.103 build_20241011VulnerableQNAP
cpe:2.3:o:qnap:qurouter:2.4.4.106:build_20241017:*:*:*:*:*:*2.4.4.106 build_20241017VulnerableQNAP
cpe:2.3:o:qnap:qurouter:2.4.5.032:build_20241029:*:*:*:*:*:*2.4.5.032 build_20241029VulnerableQNAP
cpe:2.3:o:qnap:qurouter:2.4.6.028:build_20250207:*:*:*:*:*:*2.4.6.028 build_20250207VulnerableQNAP
  • cpe:2.3:o:qnap:qurouter:2.4.0.190:build_20240522:*:*:*:*:*:* Versions 2.4.0.190 build_20240522 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qurouter:2.4.1.172:build_20240606:*:*:*:*:*:* Versions 2.4.1.172 build_20240606 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qurouter:2.4.1.634:build_20240710:*:*:*:*:*:* Versions 2.4.1.634 build_20240710 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qurouter:2.4.2.317:build_20240903:*:*:*:*:*:* Versions 2.4.2.317 build_20240903 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qurouter:2.4.2.538:build_20240923:*:*:*:*:*:* Versions 2.4.2.538 build_20240923 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qurouter:2.4.3.103:build_20241011:*:*:*:*:*:* Versions 2.4.3.103 build_20241011 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qurouter:2.4.4.106:build_20241017:*:*:*:*:*:* Versions 2.4.4.106 build_20241017 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qurouter:2.4.5.032:build_20241029:*:*:*:*:*:* Versions 2.4.5.032 build_20241029 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qurouter:2.4.6.028:build_20250207:*:*:*:*:*:* Versions 2.4.6.028 build_20250207 Vulnerable ·QNAP

Remediation

  • Fix · CNA QuRouter (QNAP Systems Inc.) Fixed in 2.4.6.028

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-13087
  2. 2026-10-03 Alias added: GHSA-7c8j-xg5r-5j56
  3. 2026-11-02 EPSS moved to the 50th–90th percentile

References

Advisory 1

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences