CVE-2024-50390 is a critical severity (CVSS 9.8) command injection in QNAP QHora routers running QuRouter. If exploited, remote attackers could run arbitrary commands. QNAP says it fixed the flaw in QuRouter 2.4.5.032 and later, so update the router firmware and avoid exposing the admin interface.
What's affected
The record names QNAP QuRouter, the operating system of QHora routers, as affected. QNAP states the fix is in QuRouter 2.4.5.032 and later.
The QNAP advisory is QSA-25-01. The record does not give the exact range of earlier versions, so treat anything below 2.4.5.032 as affected.
Routers sit on the edge of a network and bridge it to the internet, so a flaw that gives command execution deserves quick action.
How to check if you're exposed
Sign in to the QHora administration page and read the QuRouter version in the system information or firmware section. If it is below 2.4.5.032, update.
Then check whether the admin interface is reachable from the internet. The router web interface should be limited to your internal network or reached through a VPN. Review the router logs for unfamiliar logins or configuration changes.
What to do now
- Update QuRouter to 2.4.5.032 or later through the firmware update page.
- Disable remote administration from the internet.
- Change the administrator password and remove accounts you do not use.
- Back up the router configuration before and after the update.
- Review the configuration for rules or users you do not recognise.
Why it matters
The weakness is CWE-78 (OS Command Injection), where input gets passed to the operating system shell with its special characters intact. The record also lists CWE-1188 (Insecure Default Initialization) as a related classification, which points at a risky default setup. The effect is that a remote caller could run commands on the router.
The 9.8 score reflects network reach with no privileges and no user interaction. An edge router that runs attacker commands can reroute or watch traffic for everything behind it. The record does not flag exploitation, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-50390.
Quick check
Which QuRouter version fixes CVE-2024-50390?
QNAP says QuRouter 2.4.5.032 and later.
Should I leave router admin open to the internet?
No. Use a VPN or restrict the admin page to your internal network.
Sources
Last reviewed: 19 October 2026.
