CVE-2024-48860: QHora
Published Nov 22, 2024
·Updated
An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow remote attackers to execute commands.
We have already fixed the vulnerability in the following version: QuRouter 2.4.3.103 and later
Affected Software
7 affected components
QuRouter QuRouter<2.4.3.103
QHora QHora
QNAP Qurouter=2.4.0.190-build_20240522
QNAP Qurouter=2.4.1.172-build_20240606
QNAP Qurouter=2.4.1.634-build_20240710
QNAP Qurouter=2.4.2.317-build_20240903
QNAP Qurouter=2.4.2.538-build_20240923
Remediation
Information
We have already fixed the vulnerability in the following version:
QuRouter 2.4.3.103 and later
Event History
Nov 22, 2024
CVE Published
via MITRE·03:32 PM
Data Sourced
via MITRE·03:32 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Nov 25, 2024
News Published
via BleepingComputer·10:13 PM
News Published
via BleepingComputer·10:15 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-48860?
CVE-2024-48860 is classified as a critical vulnerability due to its potential for remote command execution.
2
What products are affected by CVE-2024-48860?
CVE-2024-48860 affects QuRouter versions prior to 2.4.3.103 and all versions of QHora products.
3
How do I fix CVE-2024-48860?
To fix CVE-2024-48860, upgrade QuRouter to version 2.4.3.103 or later.
4
Can CVE-2024-48860 be exploited remotely?
Yes, CVE-2024-48860 can be exploited remotely, allowing attackers to execute arbitrary commands.
5
Is there a patch available for CVE-2024-48860?
Yes, a patch is available by upgrading to QuRouter version 2.4.3.103 or later.