VDB

CVE-2024-48860

CVE-2024-48860 PUBLISHED CVSS 9.5 CRITICAL

An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow remote attackers to execute commands. We have already fixed the vulnerability in the following version: QuRouter 2.4.3.103 and later

EPSS 1.05% · 77.9th percentile

Risk Scores

CVSS 4.0
9.5
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS Score
1.05%
77.9th percentile

Affected Products

VendorProductVersions
qnapqurouter2.4.1.172, 2.4.2.317, 2.4.2.538
QNAP Systems Inc.QuRouter2.4.x
qnapqurouter2.4.0

Timeline

  • Nov 22, 2024 CVE Published
  • Nov 22, 2024 PoC Published
  • Nov 22, 2024 PoC Published
  • Nov 22, 2024 CVE Updated
  • Nov 23, 2024 EPSS Score
  • Nov 26, 2024 PoC Published
  • Nov 26, 2024 PoC Published
  • Dec 11, 2024 EPSS Score
  • Jan 15, 2025 EPSS Score
  • Feb 1, 2025 EPSS Score
  • Feb 7, 2025 Coalition ESS Score
  • Mar 8, 2025 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›