CVE-2025-62845
Received Received - Intake
Improper Neutralization Vulnerability in QHora Allows Admin Exploit

Publication date: 2026-03-20

Last updated on: 2026-04-14

Assigner: QNAP Systems, Inc.

Description
An improper neutralization of escape, meta, or control sequences vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to cause unexpected behavior. We have already fixed the vulnerability in the following version: QuRouter 2.6.3.009 and later
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-20
Last Modified
2026-04-14
Generated
2026-06-16
AI Q&A
2026-03-20
EPSS Evaluated
2026-06-14
NVD
CVE-2025-62845
EUVD
EUVD-2025-208899
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
qnap qurouter 2.6.0.239
qnap qurouter 2.6.0.688
qnap qurouter 2.6.1.028
qnap qurouter 2.6.2.007
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-150 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability involves improper neutralization of escape, meta, or control sequences in QHora. It can be exploited by a local attacker who already has an administrator account to cause unexpected behavior in the system.

Impact Analysis

If exploited, this vulnerability can cause unexpected behavior on the affected device, potentially leading to system instability or other unintended effects. However, exploitation requires the attacker to have local administrator access.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your QuRouter device to version 2.6.3.009 or later, where the issue has been fixed.

Since the vulnerability requires a local attacker with an administrator account, restricting administrator access and ensuring strong account security can also help reduce risk.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-62845. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart