Local-network arbitrary command execution

OS command injection in QNAP QuRouter before 2.4.4.106 allows local network attackers to execute arbitrary commands on the router. QNAP has not published the affected interface, parameter, or code path, so the operation that incorporates untrusted input into an operating-system command remains undisclosed. Reachability requires access to the local network; successful exploitation runs attacker-supplied commands with the privileges of the vulnerable router process.