CVE-2025-62845

Received Received - Intake

Improper Neutralization Vulnerability in QHora Allows Admin Exploit

Publication date: 2026-03-20

Last updated on: 2026-04-14

Assigner: QNAP Systems, Inc.

Description

An improper neutralization of escape, meta, or control sequences vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to cause unexpected behavior. We have already fixed the vulnerability in the following version: QuRouter 2.6.3.009 and later

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-20

Last Modified

2026-04-14

Generated

2026-07-06

AI Q&A

2026-03-20

EPSS Evaluated

2026-07-04

NVD

CVE-2025-62845

EUVD

EUVD-2025-208899

Affected Vendors & Products

Vendor	Product	Version / Range
qnap	qurouter	2.6.0.239
qnap	qurouter	2.6.0.688
qnap	qurouter	2.6.1.028
qnap	qurouter	2.6.2.007

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-150	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper neutralization of escape, meta, or control sequences in QHora. It can be exploited by a local attacker who already has an administrator account to cause unexpected behavior in the system.

Impact Analysis

If exploited, this vulnerability can cause unexpected behavior on the affected device, potentially leading to system instability or other unintended effects. However, exploitation requires the attacker to have local administrator access.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your QuRouter device to version 2.6.3.009 or later, where the issue has been fixed.

Since the vulnerability requires a local attacker with an administrator account, restricting administrator access and ensuring strong account security can also help reduce risk.

Hi! I’m here to help you understand CVE-2025-62845. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70