TI-2025-38999 Aliases CVE-2025-62846 GHSA-gfqf-8rx6-9xqw

SQL injection in QNAP QuRouter

LOW 33CWE-89Published 2026-03-20 · Updated 2026-03-25

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

An SQL injection vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: QuRouter 2.6.2.007 and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00212 11th percentileScored 2026-11-07

Fix Fixed QuRouter (QNAP Systems Inc.): 2.6.2.007

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
QNAP	QuRouter	2.6.x to before 2.6.2.007	2.6.2.007	Patch available	CNA

QuRouter VendorQNAP Affected 2.6.x to before 2.6.2.007 Fixed in 2.6.2.007 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:o:qnap:qurouter:2.6.0.239:build_20250625::::::	2.6.0.239 build_20250625	Vulnerable	QNAP
cpe:2.3:o:qnap:qurouter:2.6.0.688:build_20250818::::::	2.6.0.688 build_20250818	Vulnerable	QNAP
cpe:2.3:o:qnap:qurouter:2.6.1.028:build_20251001::::::	2.6.1.028 build_20251001	Vulnerable	QNAP

cpe:2.3:o:qnap:qurouter:2.6.0.239:build_20250625:*:*:*:*:*:* Versions 2.6.0.239 build_20250625 Vulnerable ·QNAP
cpe:2.3:o:qnap:qurouter:2.6.0.688:build_20250818:*:*:*:*:*:* Versions 2.6.0.688 build_20250818 Vulnerable ·QNAP
cpe:2.3:o:qnap:qurouter:2.6.1.028:build_20251001:*:*:*:*:*:* Versions 2.6.1.028 build_20251001 Vulnerable ·QNAP

Remediation

Fix · CNA QuRouter (QNAP Systems Inc.) Fixed in 2.6.2.007

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-03-20
QNAP Systems QuRouter 2.6.2.007
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-38997 Weak authentication in QNAP QuRouterPriority LOW 20
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2025-62846
2026-10-03 Alias added: GHSA-gfqf-8rx6-9xqw

References

Advisory 1

https://www.qnap.com/en/security-advisory/qsa-26-12

TI-2024-32560 Command injection in QNAP QuRouter CVSS 4.0CRITICAL 9.5
TI-2024-33824 SQL injection in QNAP QuRouter CVSS 4.0CRITICAL 9.5
TI-2024-33825 OS command injection in QNAP QuRouter CVSS 4.0HIGH 7.7
TI-2025-21275 QuRouter 2.5 CVSS 4.0HIGH 7.1
TI-2024-32561 Command injection in QNAP QuRouter CVSS 4.0HIGH 7.3
TI-2024-35898 Command injection in QNAP QuRouter CVSS 4.0MEDIUM 5.1

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences