Authentication Bypass in QNAP QHora-322 Routers (CVE-2025-62845) Demonstrated at Pwn2Own

Authentication Bypass in QNAP QHora-322 Routers (CVE‑2025‑62845) Demonstrated at Pwn2Own

What It Is – A remote‑authentication‑bypass flaw in the qvpn_db_mgr endpoint of QNAP QHora‑322 routers. The role_type parameter is not properly neutralized, allowing specially‑crafted escape sequences to skip VPN login checks.

Exploitability – Actively exploited in the Pwn2Own competition; proof‑of‑concept code released. CVSS v3.1 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) – medium severity but with a low barrier to execution.

Affected Products – QNAP QHora‑322 VPN router (firmware versions prior to the March 2026 security update).

TPRM Impact – Organizations that rely on QHora‑322 for site‑to‑site or remote‑user VPN connectivity inherit a supply‑chain risk: an attacker who compromises the router can pivot into internal networks, exfiltrate data, or disrupt services.

Recommended Actions –

1. Deploy QNAP’s March 2026 firmware patch immediately (see QNAP Security Advisory QSA‑26‑12).
2. Conduct an inventory of all QHora‑322 devices across the enterprise and verify patch status.
3. If patching cannot be performed within 48 hours, temporarily disable the VPN service or restrict access to trusted IP ranges.
4. Enable strict logging and monitor for anomalous qvpn_db_mgr requests or authentication‑bypass attempts.
5. Review network segmentation to ensure that a compromised router cannot directly reach critical assets.

Source: Zero Day Initiative Advisory ZDI‑26‑240