Threat Intelligence Database

An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later

A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and later

An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later

CVE-2025-62843 is a vulnerability in QNAP Systems Inc. QuRouter affecting version 2.6.x. It involves improper restriction of communication channels to intended endpoints, which could allow an attacker with physical access to gain privileges intended for the original endpoint. The vulnerability has been fixed in QuRouter version 2.6.3.009 and later. The CVSS 4.

CVE-2025-62844 is a medium severity vulnerability in QNAP Systems Inc. QuRouter affecting version 2.6.x. It involves weak authentication that could allow an attacker with local network access to gain sensitive information. The vulnerability has been fixed in QuRouter version 2.6.2.007 and later. There are no known exploits in the wild at this time.

CVE-2025-62845 is a medium severity vulnerability in QNAP Systems Inc. QuRouter versions 2.6.x. It involves improper neutralization of escape, meta, or control sequences (CWE-150). A local attacker with administrator privileges can exploit this flaw to cause unexpected behavior. The vulnerability has been fixed in QuRouter version 2.6.3.009 and later.

CVE-2025-62846 is an SQL injection vulnerability affecting QNAP Systems Inc. QuRouter versions 2.6.x. A local attacker with administrator privileges can exploit this vulnerability to execute unauthorized code or commands. The vulnerability has been fixed in QuRouter version 2.6.2.007 and later. The CVSS 4.

CVE-2024-13088 is an improper authentication vulnerability in QNAP Systems Inc. QuRouter that allows an attacker with local network access to compromise system security. The issue affects QuRouter versions 2.5.x and was fixed in version 2.5.0.140 and later. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.

MediumVulnerabilityGermanyFranceItaly+6#cve#cve-2024-13088#cwe-287

A command injection vulnerability has been reported to affect QHora. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuRouter 2.4.6.028 and later

LowVulnerabilityGermanyFranceItaly+7#cve#cve-2024-13087#cwe-78