Which versions of Qurouter are affected by CVE-2025-62844?

Organizations using sensitive information. We have already fixed the vulnerability in the following should be aware of moderate risk from CVE-2025-62844 rated CVSS 4.0.. A patch is available.

How to fix or mitigate CVE-2025-62844?

Within 30 days: Identify affected systems running sensitive information. We have already fixed the vulnerabil and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Qurouter CVE-2025-62844

Q: What is the CVSS score of CVE-2025-62844?

CVE-2025-62844 has a CVSS 4.0 base score of 4.0 (Medium). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-208897 MEDIUM

Weak Authentication (CWE-1390)

2026-03-20 qnap

Information Disclosure Qurouter

4.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

4.0 MEDIUM

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.6.2.007

EUVD ID Assigned

Mar 20, 2026 - 16:30 euvd

EUVD-2025-208897

Analysis Generated

Mar 20, 2026 - 16:30 vuln.today

CVE Published

Mar 20, 2026 - 16:21 nvd

MEDIUM 4.0

DescriptionCVE.org

A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to gain sensitive information.

We have already fixed the vulnerability in the following version: QuRouter 2.6.2.007 and later

AnalysisAI

A weak authentication vulnerability exists in QNAP QHora/QuRouter devices that allows attackers with local network access to bypass authentication mechanisms and disclose sensitive information. The vulnerability affects QuRouter versions prior to 2.6.2.007, and exploitation requires network-level access but no special privileges. While no CVSS score or EPSS data is publicly available, the classification as CWE-1390 (Weak Authentication) and the emphasis on local network access indicates this is a network-adjacent threat with moderate real-world risk, particularly in environments where untrusted devices can connect to the local network.

Technical ContextAI

This vulnerability is rooted in CWE-1390 (Weak Authentication), which encompasses failures in authentication mechanisms such as insufficient credential validation, predictable authentication tokens, or logic flaws in access control. In the context of QNAP QuRouter (CPE: cpe:2.3:a:qnap_systems_inc.:qurouter:*:*:*:*:*:*:*:*), the affected product is a network routing appliance that manages network traffic and connectivity. The weakness appears to stem from inadequate authentication enforcement at the application or API level, allowing attackers on the same network segment to extract sensitive configuration or operational data without proper credentials. The fix in version 2.6.2.007 and later suggests the vendor implemented stronger authentication mechanisms, likely including improved token handling, stricter credential validation, or enhanced access control enforcement.

RemediationAI

Upgrade QNAP QuRouter to firmware version 2.6.2.007 or later immediately. Visit the official QNAP security advisory at https://www.qnap.com/en/security-advisory/qsa-26-12 for patch download links and detailed upgrade instructions. As an interim control, restrict local network access to the QuRouter's management interface by implementing network segmentation—isolate the device on a dedicated management VLAN with access only from authorized administrative systems and block untrusted devices from reaching the management ports. Additionally, disable any unnecessary services or APIs on the QuRouter and ensure strong, unique administrative credentials are in use. After patching, verify the update completed successfully and monitor device logs for any exploitation attempts.