{"id":"CVE-2024-48861","aliases":["EUVD-2024-43182","GHSA-m5jm-j4cj-7522"],"status":"published","title":"QHora","description":"An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local network attackers to execute commands.\n\nWe have already fixed the vulnerability in the following versions:\nQuRouter 2.4.4.106 and later","severity":{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0076,"percentile":0.5578,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-77","CWE-78"],"published":"2024-11-22T15:32:01Z","modified":"2026-06-17T07:58:54Z","products":[{"vendor":"qnap","product":"qurouter"},{"vendor":"qnap systems inc.","product":"qurouter"}],"references":[{"url":"https://www.qnap.com/en/security-advisory/qsa-24-44","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48861"},{"url":"https://github.com/advisories/GHSA-m5jm-j4cj-7522"}],"sources":{"cve":[{"id":"CVE-2024-48861","title":"QHora","description":"An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local network attackers to execute commands.\n\nWe have already fixed the vulnerability in the following versions:\nQuRouter 2.4.4.106 and later","status":"published","published":"2024-11-22T15:32:01.006Z","modified":"2024-11-26T15:57:56.198Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T14:34:11.638716Z"}],"euvd":[{"id":"EUVD-2024-43182","description":"An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local network attackers to execute commands.\n\nWe have already fixed the vulnerability in the following versions:\nQuRouter 2.4.4.106 and later","status":"published","published":"2024-11-22T15:32:01Z","modified":"2024-11-26T15:57:56Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"updated_at":"2026-11-03T00:04:47.062662Z"}],"ghsa":[{"id":"GHSA-m5jm-j4cj-7522","title":"An OS command injection vulnerability has been reported to affect several product versions. If...","description":"An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local network attackers to execute commands.\n\nWe have already fixed the vulnerability in the following versions:\nQuRouter 2.4.4.106 and later","status":"published","published":"2024-11-22T21:32:15Z","modified":"2025-09-24T21:31:38Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T15:03:45.337499Z"}],"nvd":[{"id":"CVE-2024-48861","description":"An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local network attackers to execute commands.\n\nWe have already fixed the vulnerability in the following versions:\nQuRouter 2.4.4.106 and later","status":"published","published":"2024-11-22T16:15:28.483Z","modified":"2026-06-17T07:58:54.78Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T14:10:37.996328Z"}]}}