CVE-2025-62846
CWE-89Published: March 20, 2026· Updated: Mar 24, 2026
Official Description
An SQL injection vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version:
QuRouter 2.6.2.007 and later
Technical Analysis
CVE-2025-62846 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
From a weakness classification perspective (CWE-89): SQL injection vulnerabilities allow attackers to manipulate database queries, potentially exposing or modifying sensitive data.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (1)
Quick Facts
Related CVEs (CWE-89)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2025-62846 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts