CVE-2025-29887

published 2025-08-29

CVE-2025-29887: A command injection vulnerability has been reported to affect QuRouter 2.5.1. If a remote attacker gains an administrator account, they can then exploit the…

high 7.1 CVSS 4.0

AV N AC H AT P PR H UI A VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A command injection vulnerability has been reported to affect QuRouter 2.5.1. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following version:
QuRouter 2.5.1.060 and later

Affected

3 ranges

Vendor	Product	Version range	Fixed in
qnap	qurouter	—	—
qnap	qurouter	—	—
qnap_systems_inc	qurouter	>= 2.5.x < 2.5.1.060	2.5.1.060

CWE-77 CWE-78