CVE-2024-53700
Published: 07 March 2025
Description
Adversaries may abuse Unix shell commands and scripts for execution.
Security Summary
CVE-2024-53700 is a command injection vulnerability (CWE-77, CWE-78) affecting QHora devices running QuRouter firmware versions prior to 2.4.6.028. Published on 2025-03-07, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating a high-severity issue that enables attackers to execute arbitrary commands.
Remote attackers who have already gained administrator access can exploit this vulnerability over the network with low complexity and no user interaction. Successful exploitation grants high-impact privileges, allowing full compromise of confidentiality, integrity, and availability on the targeted QHora device.
QNAP's security advisory (QSA-25-07) confirms the vulnerability has been fixed in QuRouter 2.4.6.028 and later versions. Administrators should immediately update affected QHora devices to mitigate the risk, as detailed at https://www.qnap.com/en/security-advisory/qsa-25-07.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Command injection (CWE-77/78) directly enables arbitrary command execution on the Linux-based QuRouter firmware, mapping to Unix Shell interpreter usage.