PT-2025-24288 · Qhora+1 · Qhora+1

Published 2025-06-06 · Updated 2025-09-24 · CVE-2024-13087

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QuRouter versions prior to 2.4.6.028

Description A command injection issue has been reported, affecting QHora. An attacker with local network access and an administrator account can exploit this to execute arbitrary commands.

Recommendations For versions prior to 2.4.6.028, update to QuRouter version 2.4.6.028 or later to resolve the issue.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-13087

ZDI-25-871

Affected Products

Qhora

Qurouter

References · 9

• https://qnap.com/en/security-advisory/qsa-25-15 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13087 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13087 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-871 · Security Note
• https://twitter.com/TheZDIBugs/status/1960439420617732365 · Twitter Post
• https://t.me/cvenotify/125075 · Telegram Post
• https://t.me/cveNotify/136357 · Telegram Post
• https://twitter.com/SystemTek_UK/status/1961316698008572080 · Twitter Post
• https://twitter.com/CVEnew/status/1931037252177514562 · Twitter Post