VDB

CVE-2024-48860

CVE-2024-48860 PUBLISHED CVSS 9.5 CRITICAL

An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow remote attackers to execute commands. We have already fixed the vulnerability in the following version: QuRouter 2.4.3.103 and later

EPSS 1.46% · 72.7th percentile

Risk Scores

CVSS 4.0
9.5
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS Score
1.46%
72.7th percentile

Affected Products

VendorProductVersions
qnapqurouter2.4.1.172, 2.4.2.317, 2.4.2.538
QNAP Systems Inc.QuRouter2.4.x
qnapqurouter2.4.0

Timeline

  • Nov 22, 2024 CVE Published
  • Nov 22, 2024 PoC Published
  • Nov 22, 2024 PoC Published
  • Nov 23, 2024 EPSS Score
  • Nov 26, 2024 PoC Published
  • Nov 26, 2024 PoC Published
  • Dec 12, 2024 EPSS Score
  • Jan 17, 2025 EPSS Score
  • Feb 3, 2025 EPSS Score
  • Feb 7, 2025 Coalition ESS Score
  • Feb 21, 2025 EPSS Score
  • Mar 17, 2025 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›