Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An SQL injection vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: QuRouter 2.6.2.007 and later
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
3 versions affected across 1 product
| Date | Total | Labels |
|---|
| 2026-03-20 | 1 | Disclosure1 |
| 2026-03-22 | 2 | Disclosure2 |
| 2026-03-23 | 1 | Patch1 |
| 2026-03-29 | 1 | Patch1 |
QNAP patches vulnerabilities CVE-2025-62843 to CVE-2025-62846 https://hostingtech.net/qnap-patches-vulnerabilities-cve-2025-62843-to-cve-2025-62846/ via @HostingTech https://t.co/g75JBxNaqm
Post summary
QNAP has released patches for CVE-2025-62843 through CVE-2025-62846; the tweet provides no exploit or vulnerability details.
QNAP patches critical vulnerabilities including four SD-WAN router bugs showcased at Pwn2Own Ireland 2025 (CVE-2025-62843 to CVE-2025-62846). Fixes cover QuNetSwitch and QVR Pro. #QNAPSecurity #SDWAN #Ireland https://ift.tt/GW4BN0i
Post summary
QNAP has issued patches for four critical SD‑WAN router CVEs identified at Pwn2Own Ireland 2025, covering QuNetSwitch and QVR Pro.
🚨*CVE* CVE-2025-62846 An SQL injection vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to execu… https://www.cve.org/CVERecord?id=CVE-2025-62846 ----- Traducción: CVE-2025-62846 Se … http://infoflow.cloud`
Post summary
A new SQL injection vulnerability (CVE‑2025‑62846) affecting QHora is reported, noting that a local attacker with admin rights can exploit it to execute code. No PoC, exploit tools, patch information, or evidence of active exploitation is provided.
CVE-2025-62846 An SQL injection vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to execu… https://www.cve.org/CVERecord?id=CVE-2025-62846
Post summary
Short notice announcing an SQL injection vulnerability in QHora that requires local admin access; no PoC, exploit, or patch info is provided.
CVE-2025-62846 SQL Injection in QHora Router Enables Unauthorized Code Execution via Admin Account https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-62846
Post summary
The text announces CVE-2025-62846 as a SQL injection flaw in QHora Router that permits unauthorized code execution through the admin account.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | qnap | qurouter | 2.6.0.239 | - | - |
| OS | qnap | qurouter | 2.6.0.688 | - | - |
| OS | qnap | qurouter | 2.6.1.028 | - | - |