ZDI-CAN-28423: ZDI-26-240: (Pwn2Own) QNAP QHora-322 qvpn_db_mgr role_type Improper Neutralization of Escape Sequences Authentication Bypass Vulnerability

Published Mar 30, 2026

Updated

This vulnerability allows remote attackers to bypass authentication on affected QNAP QHora-322 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 6.3. The following CVEs are assigned: CVE-2025-62845.

Affected Software

1 affected component

QNAP QHora-322

Event History

Mar 30, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-28423?

ZDI-CAN-28423 has a CVSS rating of 6.3, indicating a medium severity level.

How do I fix ZDI-CAN-28423?

To mitigate ZDI-CAN-28423, update your QNAP QHora-322 router to the latest firmware version provided by the vendor.

Who is affected by ZDI-CAN-28423?

Users of the QNAP QHora-322 routers are vulnerable to the ZDI-CAN-28423 authentication bypass issue.

What type of vulnerability is ZDI-CAN-28423?

ZDI-CAN-28423 is classified as an authentication bypass vulnerability due to improper neutralization of escape sequences.

Can ZDI-CAN-28423 be exploited remotely?

Yes, ZDI-CAN-28423 can be exploited by remote attackers who can bypass the authentication on affected routers.