TI-2024-32560 Aliases CVE-2024-48860 GHSA-8qxc-g23q-chq5

Command injection in QNAP QuRouter

MEDIUM 52CWE-77Published 2024-11-22 · Updated 2024-11-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow remote attackers to execute commands. We have already fixed the vulnerability in the following version: QuRouter 2.4.3.103 and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01463 73rd percentileScored 2026-11-07

Fix Fixed QuRouter (QNAP Systems Inc.): 2.4.3.103

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
QNAP	QuRouter	2.4.x to before 2.4.3.103	2.4.3.103	Patch available	CNA

QuRouter VendorQNAP Affected 2.4.x to before 2.4.3.103 Fixed in 2.4.3.103 Patch available CNA

CPE configurations NVD · 5

CPE	Versions	Role	Vendor
cpe:2.3:o:qnap:qurouter:2.4.0.190:build_20240522::::::	2.4.0.190 build_20240522	Vulnerable	QNAP
cpe:2.3:o:qnap:qurouter:2.4.1.172:build_20240606::::::	2.4.1.172 build_20240606	Vulnerable	QNAP
cpe:2.3:o:qnap:qurouter:2.4.1.634:build_20240710::::::	2.4.1.634 build_20240710	Vulnerable	QNAP
cpe:2.3:o:qnap:qurouter:2.4.2.317:build_20240903::::::	2.4.2.317 build_20240903	Vulnerable	QNAP
cpe:2.3:o:qnap:qurouter:2.4.2.538:build_20240923::::::	2.4.2.538 build_20240923	Vulnerable	QNAP

cpe:2.3:o:qnap:qurouter:2.4.0.190:build_20240522:*:*:*:*:*:* Versions 2.4.0.190 build_20240522 Vulnerable ·QNAP
cpe:2.3:o:qnap:qurouter:2.4.1.172:build_20240606:*:*:*:*:*:* Versions 2.4.1.172 build_20240606 Vulnerable ·QNAP
cpe:2.3:o:qnap:qurouter:2.4.1.634:build_20240710:*:*:*:*:*:* Versions 2.4.1.634 build_20240710 Vulnerable ·QNAP
cpe:2.3:o:qnap:qurouter:2.4.2.317:build_20240903:*:*:*:*:*:* Versions 2.4.2.317 build_20240903 Vulnerable ·QNAP
cpe:2.3:o:qnap:qurouter:2.4.2.538:build_20240923:*:*:*:*:*:* Versions 2.4.2.538 build_20240923 Vulnerable ·QNAP

Remediation

Fix · CNA QuRouter (QNAP Systems Inc.) Fixed in 2.4.3.103

Timeline

2026-10-02 Threatist record created from CVE-2024-48860
2026-10-03 Alias added: GHSA-8qxc-g23q-chq5

References

Advisory 1

https://www.qnap.com/en/security-advisory/qsa-24-44

TI-2024-33824 SQL injection in QNAP QuRouter CVSS 4.0CRITICAL 9.5
TI-2024-33825 OS command injection in QNAP QuRouter CVSS 4.0HIGH 7.7
TI-2025-21275 QuRouter 2.5 CVSS 4.0HIGH 7.1
TI-2024-32561 Command injection in QNAP QuRouter CVSS 4.0HIGH 7.3
TI-2025-38999 SQL injection in QNAP QuRouter CVSS 4.0HIGH 7.3
TI-2024-35898 Command injection in QNAP QuRouter CVSS 4.0MEDIUM 5.1

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences