CVE-2025-62843

Published: Mar 20, 2026Modified: Jun 17, 2026

0.9

Vector

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security@qnapsecurity.com.tw (Secondary)

Description

An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, they can then exploit the vulnerability to gain the privileges that were intended for the original endpoint. We have already fixed the vulnerability in the following version: QuRouter 2.6.3.009 and later

Affected (4)

Products: Qnap: Qurouter

Qnap

1 product

Qurouter

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Qnap Qurouter	Version 2.6.0.239 build_20250625
Qnap Qurouter	Version 2.6.0.688 build_20250818
Qnap Qurouter	Version 2.6.1.028 build_20251001
Qnap Qurouter	Version 2.6.2.007 build_20251027

Related CWEs

CWE-923

Improper Restriction of Communication Channel to Intended Endpoints

The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

References (1)

https://www.qnap.com/en/security-advisory/qsa-26-12

Source: security@qnapsecurity.com.tw

Vendor Advisory

Timeline

No history available yet.