An improper neutralization of escape, meta, or control sequences has been reported to affect QNAP QuRouter. The vulnerability, identified as CWE‑150, allows a local attacker with administrator privileges to input crafted data that bypasses sanitization, which can lead to unexpected behavior of the router. No remote code execution or denial‑of‑service capability is indicated in the supplied description.

QNAP Systems Inc. QuRouter firmware versions before 2.6.3.009 are vulnerable. Specifically, the builds 2.6.0.239 (build_20250625), 2.6.0.688 (build_20250818), 2.6.1.028 (build_20251001), and 2.6.2.007 (build_20251027) are listed as affected. Users should verify the firmware version on each device to determine exposure.

The CVSS score of 5.6 places this issue in the moderate severity range, while an EPSS score below 1 % indicates a low probability of exploitation. Since the flaw requires local administrator privileges, it poses a risk only to trusted or compromised accounts. The vendor has released a patch in firmware 2.6.3.009 and later, simplifying mitigation.