An SQL injection flaw in the QHora component of QNAP QuRouter enables an attacker who has local administrator privileges to inject malicious SQL statements. This capability can lead to the execution of unauthorized code or system commands on the device, compromising data confidentiality, integrity, and availability. The weakness is formally identified as CWE‑89.

The vulnerability affects QNAP Systems Inc.’s QuRouter firmware versions 2.6.0.239 (build_20250625), 2.6.0.688 (build_20250818), and 2.6.1.028 (build_20251001). All releases prior to 2.6.2.007 are impacted; versions 2.6.2.007 and later contain the fix.

The CVSS base score of 7.3 indicates High severity, but the EPSS score of less than 1% and absence from the CISA KEV catalogue suggest a low likelihood of widespread exploitation. The attack requires local admin access, so the risk is confined to environments where such credentials exist or are poorly managed. Devices with exposed local admin interfaces remain the primary threat vector.