CVE-2024-50390CWE-1188CWE-78

QHora

High · published March 7, 2025

CVSS v4.0
7.7
EPSS
1%
Percentile
64.0
In the wild
Unconfirmed
What it is

⚡ A command injection vulnerability is lurking in QHora like an uninvited party crasher ready to take over the dance floor! 🔥 Think of it like a restaurant where someone manages to pass a note to the chef, telling them to whip up whatever dish they want without any checks — it could turn into a gastronomical disaster! If exploited, attackers could strut right in and execute arbitrary commands on your QHora devices. This means they could potentially take control, access sensitive data, or even disrupt your network without breaking a sweat. Yikes!

Put simply

Think of it like a restaurant where someone manages to pass a note to the chef, telling them to whip up whatever dish they want without any checks — it could turn into a gastronomical disaster! This command injection vulnerability allows unauthorized users to run arbitrary commands on the affected QHora devices, taking advantage of insufficient input validation.

What to do

If exploited, attackers could strut right in and execute arbitrary commands on your QHora devices. This means they could potentially take control, access sensitive data, or even disrupt your network without breaking a sweat. Yikes! To protect your system, upgrade to QuRouter version 2.4.5.032 or later immediately. Also, review your input validation processes to ensure they are robust against future exploits. You can tackle this! Get that patch applied and your devices will be safe and sound. 🛡️

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01051 · 64.0th percentile
Weaknesses
CWE-1188 · Initialization of a Resource with an Insecure Default; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-03-07T16:13Z
EPSS history
Timeline
  • 07 MAR 16:13Z
    QHora
    cvelistv5