Critical Remote Code Execution in QNAP QHora‑322 (CVE‑2025‑62846) via SQL Injection
What It Is – A critical SQL‑injection flaw (CVE‑2025‑62846) resides in the qvpn_db_mgr module of QNAP’s QHora‑322 VPN router. The flaw permits an attacker to bypass authentication and execute arbitrary commands as root.
Exploitability – The vulnerability has a CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). A proof‑of‑concept was demonstrated at the Pwn2Own competition; no public exploit kits have been observed yet, but the attack surface is fully remote.
Affected Products – QNAP QHora‑322 routers (firmware versions prior to the March 2026 security update).
TPRM Impact – The router is often deployed as a gateway for remote office sites, partner networks, and SaaS‑hosted services. Compromise can give threat actors unfettered network access, enabling downstream attacks on connected third‑party services and data exfiltration.
Recommended Actions –
- Verify firmware version on all QHora‑322 devices; apply QNAP security advisory QSA‑26‑12 immediately.
- Enforce network segmentation: isolate QHora‑322 routers from critical internal assets.
- Review and harden authentication mechanisms; disable any default accounts.
- Update third‑party risk registers to reflect the new vulnerability and reassess any vendors relying on QNAP networking hardware.
- Monitor logs for anomalous VPN‑related queries or unexpected root‑level processes.