CVE-2025-29887 HIGH

CVE-2025-29887: QuRouter 2.5

Vendor Qnap Systems Inc.
Product QuRouter
Weakness CWE-77
Published August 29, 2025
Last update August 29, 2025

CVSS base score

7.1/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A command injection vulnerability has been reported to affect QuRouter 2.5.1. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuRouter 2.5.1.060 and later

Key dates

02Disclosure timeline

August 29, 2025 CVE published
August 29, 2025 Record updated