The vulnerability in QHora arises from improper neutralization of escape, meta, or control sequences. If a local attacker gains an administrator account, they can use this flaw to trigger unexpected behavior within the system. This weakness can potentially disrupt normal operations or expose sensitive information, depending on the context of the exploited feature.

Vendor QNAP Systems Inc. provides the QuRouter device. All builds of the product before version 2.6.3.009 are considered susceptible, as the vendor’s advisory states the issue is corrected starting from that release.

The CVSS score of 5.6 indicates moderate severity, and the lack of a publicly disclosed exploit or inclusion in the CISA KEV list suggests limited current threat. However, the flaw requires local administrative access, which attackers might achieve through physical access or compromise of other privileged accounts. Updating to the patched firmware is the most effective countermeasure.