Qurouter CVE-2024-13088

CVSS 7.8 (High) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates this is a high-impact vulnerability with favorable attack conditions for local network attackers. The local attack vector (AV:L) limits exposure to attackers on the same network segment but is typical for router/gateway vulnerabilities. Low attack complexity and low privilege requirements significantly increase exploitability—an attacker needs minimal credentials or network position. The high impact across confidentiality, integrity, and availability suggests complete system compromise is possible (e.g., data exfiltration, configuration modification, denial of service). Without EPSS scores or KEV confirmation, real-world prioritization should consider: (1) the device's network exposure (internal vs. internet-facing), (2) whether the low-privilege account requirement aligns with typical IoT/network device deployments, and (3) patch adoption rates in customer bases. For organizations running QuRouter versions before 2.5.0.140, this warrants immediate assessment and patching, particularly if devices are internet-accessible or in untrusted network segments.

An attacker gains access to the internal network segment where a QuRouter device operates (e.g., via compromised employee device, rogue WiFi access point, or guest network). The attacker uses a low-privilege account (such as a guest or read-only service account) already present on the network or environment. Due to improper authentication in the QuRouter's management API or inter-service communication, the attacker bypasses authentication controls without user interaction and escalates to full administrative access. From this position, the attacker modifies router configurations, intercepts traffic, exfiltrates data, or disables security functions. Attack complexity is low because exploitation is straightforward—likely a direct API call or service exploitation requiring no unusual techniques. No proof-of-concept availability is confirmed in the provided intelligence, but the low attack complexity suggests one could be developed or may already exist in security research communities.