CVE-2024-50389

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-50389
A SQL injection vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to inject malicious code. We have already fixed the vulnerability in the following version: QuRouter 2.4.5.032 and later

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.qnap.com/en/security-advisory/qsa-24-45 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:qnap:qurouter:2.4.0.190:build_20240522:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.1.172:build_20240606:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.1.634:build_20240710:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.2.317:build_20240903:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.2.538:build_20240923:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.3.103:build_20241011:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.4.106:build_20241017:*:*:*:*:*:*
History

24 Sep 2025, 19:18

Type Values Removed Values Added
Summary
  • (es) Se ha informado de una vulnerabilidad de inyección SQL que afecta a QuRouter. Si se explota, la vulnerabilidad podría permitir a atacantes remotos inyectar código malicioso. Ya hemos corregido la vulnerabilidad en la siguiente versión: QuRouter 2.4.5.032 y posteriores
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
References () https://www.qnap.com/en/security-advisory/qsa-24-45 - () https://www.qnap.com/en/security-advisory/qsa-24-45 - Vendor Advisory
CPE cpe:2.3:o:qnap:qurouter:2.4.4.106:build_20241017:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.1.172:build_20240606:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.1.634:build_20240710:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.2.538:build_20240923:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.3.103:build_20241011:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.2.317:build_20240903:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.0.190:build_20240522:*:*:*:*:*:*
First Time Qnap qurouter
Qnap

06 Dec 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-06 17:15

Updated : 2025-09-24 19:18

NVD link : CVE-2024-50389

Mitre link : CVE-2024-50389

CVE.ORG link : CVE-2024-50389

JSON object : View

Products Affected

qnap

  • qurouter
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')