Which versions of Qurouter are affected by CVE-2025-62843?

CVE-2025-62843 is a low-severity vulnerability (CVSS 0.9). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.. A patch is available.

How to fix or mitigate CVE-2025-62843?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Qurouter CVE-2025-62843

Q: What is the CVSS score of CVE-2025-62843?

CVE-2025-62843 has a CVSS 4.0 base score of 0.9 (Low). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-208895 LOW

Improper Restriction of Communication Channel to Intended Endpoints (CWE-923)

2026-03-20 qnap

Information Disclosure Qurouter

0.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

0.9 LOW

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.6.3.009

EUVD ID Assigned

Mar 20, 2026 - 16:30 euvd

EUVD-2025-208895

Analysis Generated

Mar 20, 2026 - 16:30 vuln.today

CVE Published

Mar 20, 2026 - 16:22 nvd

LOW 0.9

DescriptionCVE.org

An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, they can then exploit the vulnerability to gain the privileges that were intended for the original endpoint.

We have already fixed the vulnerability in the following version: QuRouter 2.6.3.009 and later

AnalysisAI

An improper restriction of communication channel to intended endpoints vulnerability (CWE-923) has been identified in QNAP QHora devices, allowing attackers with physical access to exploit insufficient endpoint validation and gain privileges intended for legitimate endpoints. The vulnerability affects QHora/QuRouter products prior to version 2.6.3.009. While no CVSS score or EPSS data is currently available and the vulnerability does not appear in active exploitation databases (KEV), the physical access requirement significantly constrains real-world exploitability, though the privilege escalation impact remains concerning for organizations with physical security controls.

Technical ContextAI

This vulnerability exists in QNAP QHora/QuRouter networking appliances and stems from improper validation of communication endpoints, classified under CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints). The root cause involves insufficient cryptographic or logical verification mechanisms that authenticate whether communication originates from or is destined to authorized endpoints. In the context of network routing and management interfaces, this could manifest as weak certificate validation, missing mutual TLS authentication, or inadequate MAC address/hardware binding verification. The affected product (CPE: cpe:2.3:a:qnap_systems_inc.:qurouter:*:*:*:*:*:*:*:*) is a commercial routing appliance where such communication channel flaws could allow an attacker with physical access to the device or its local network to impersonate legitimate management endpoints.

RemediationAI

Immediately upgrade affected QHora and QuRouter devices to firmware version 2.6.3.009 or later, available from QNAP's security advisory at https://www.qnap.com/en/security-advisory/qsa-26-12. Until patching can be completed, enforce strict physical access controls to network appliances, disable unnecessary management interfaces, restrict management access to trusted networks only via firewall rules, and isolate QHora/QuRouter devices on dedicated VLAN segments with egress filtering. Additionally, enable all available authentication mechanisms (mutual TLS, certificate pinning if supported) and monitor device logs for unauthorized endpoint connection attempts.