CVE-2025-68403 PUBLISHED

Inadequate Steps to Confirm Vulnerability in QuRouter

Assigner: qnap
Reserved: 17.12.2025 Published: 15.10.2026 Updated: 15.10.2026

An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system.

We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score: 4.6

Product Status

Vendor QNAP Systems Inc.
Product QuRouter
Versions Default: unaffected
  • affected from 2.7.x to 2.7.2.113 (excl.)

Solutions

We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later

Credits

  • 蒲宗賢 finder

References

Problem Types

  • CWE-15 CWE

Impacts

  • CAPEC-176