{"id":"CVE-2024-48861","state":"PUBLISHED","title":"QHora","description":"An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local network attackers to execute commands.\n\nWe have already fixed the vulnerability in the following versions:\nQuRouter 2.4.4.106 and later","publishedAt":"2024-11-22T15:32:01.006Z","updatedAt":"2024-11-26T15:57:56.198Z","severity":{"score":7.3,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","source":"qnap"},"assigner":"qnap","products":["QNAP Systems Inc. QuRouter"],"affected":[{"vendor":"QNAP Systems Inc.","product":"QuRouter","defaultStatus":"unaffected","versions":[{"version":"2.4.x","status":"affected","lessThan":"2.4.4.106","versionType":"custom"}]}],"references":["https://www.qnap.com/en/security-advisory/qsa-24-44"],"weaknesses":["CWE-77","CWE-78"],"ingestedAt":"2026-10-29T20:07:56.516Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/48xxx/CVE-2024-48861.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-48861","state":"PUBLISHED","datePublished":"2024-11-22T15:32:01.006Z","dateUpdated":"2024-11-26T15:57:56.198Z","assignerShortName":"qnap","assignerOrgId":"2fd009eb-170a-4625-932b-17a53af1051f","dateReserved":"2024-10-09T00:22:57.834Z"},"containers":{"cna":{"title":"QHora","descriptions":[{"lang":"en","value":"An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local network attackers to execute commands.\n\nWe have already fixed the vulnerability in the following versions:\nQuRouter 2.4.4.106 and later"}],"affected":[{"vendor":"QNAP Systems Inc.","product":"QuRouter","defaultStatus":"unaffected","versions":[{"version":"2.4.x","status":"affected","lessThan":"2.4.4.106","versionType":"custom"}]}],"references":[{"url":"https://www.qnap.com/en/security-advisory/qsa-24-44"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"PHYSICAL","baseScore":7.3,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-77","description":"CWE-77","lang":"en","type":"CWE"},{"cweId":"CWE-78","description":"CWE-78","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"qnap","orgId":"2fd009eb-170a-4625-932b-17a53af1051f","dateUpdated":"2024-11-22T15:32:01.006Z"},"credits":[{"lang":"en","type":"finder","value":"Midnight Blue / PHP Hooligans"}],"impacts":[{"capecId":"CAPEC-88","descriptions":[{"lang":"en","value":"CAPEC-88"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"We have already fixed the vulnerability in the following versions:<br>QuRouter 2.4.4.106 and later<br>"}],"value":"We have already fixed the vulnerability in the following versions:\nQuRouter 2.4.4.106 and later"}],"source":{"advisory":"QSA-24-44","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"qnap","product":"qurouter","defaultStatus":"unknown","versions":[{"version":"2.4.0","status":"affected","lessThan":"2.4.4.106","versionType":"custom"}],"cpes":["cpe:2.3:a:qnap:qurouter:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-48861","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2024-11-22T16:35:49.001964Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-26T15:57:56.198Z"}}]}}}