What is the CVSS score of EUVD-2024-54652?

EUVD-2024-54652 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Qurouter are affected by EUVD-2024-54652?

CVE-2024-13088 is a high-severity authentication bypass in QHora/QuRouter that allows attackers on the local network with minimal privileges to fully compromise affected systems without user…. A patch is available.

How to fix or mitigate EUVD-2024-54652?

Within 24 hours: Identify all QuRouter installations and document current versions. Within 7 days: Upgrade QHora/QuRouter to version 2.5.0.140 or later on all affected systems; prioritize internet-facing and critical infrastructure deployments. Within 30 days: Complete inventory audit and verify successful patch deployment; implement network segmentation to restrict local network access to QuRouter management interfaces.

Qurouter EUVD-2024-54652

| CVE-2024-13088 HIGH

Improper Authentication (CWE-287)

2025-06-06 security@qnapsecurity.com.tw

Authentication Bypass Qurouter

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:45 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.5.0.140

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2024-54652

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 16:15 nvd

HIGH 7.8

DescriptionCVE.org

An improper authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version: QuRouter 2.5.0.140 and later

AnalysisAI

CVE-2024-13088 is an improper authentication vulnerability (CWE-287) affecting QHora/QuRouter that allows local network attackers with low privileges to compromise system confidentiality, integrity, and availability. The vulnerability requires local network access and low privileges but no user interaction, making it a significant risk for networked environments. Patch versions QuRouter 2.5.0.140 and later are available, though KEV/EPSS data and active exploitation status are not confirmed in the provided intelligence.

Technical ContextAI

The vulnerability stems from improper authentication mechanisms in QHora/QuRouter network devices (CWE-287 - Improper Authentication). This class of weakness indicates the device fails to properly verify the identity of users, processes, or systems before granting access to resources. Based on the CVSS vector (AV:L/AC:L/PR:L), the authentication bypass occurs at the local network level, suggesting the device's management interface, inter-process communication, or local service authentication is flawed. The low attack complexity indicates the exploitation method is straightforward and does not require special conditions or techniques. QHora appears to be a networking product line with QuRouter as a specific model variant.

RemediationAI

Upgrade QuRouter firmware to version 2.5.0.140 or later; priority: Critical; details: Vendor has confirmed the vulnerability is fixed in QuRouter 2.5.0.140 and subsequent releases. Organizations should prioritize deployment of this patch or later versions. Workaround/Mitigation: Network Segmentation; details: Restrict local network access to QuRouter devices through network access control lists (ACLs), firewall rules, or VLAN segmentation. Limit access to management interfaces to trusted administrative networks only. Workaround/Mitigation: Privilege Access Management; details: Enforce strong authentication for any local network accounts with elevated privileges. Implement network monitoring to detect unauthorized authentication attempts or unusual access patterns. Detection: Monitor logs for suspicious authentication events on QuRouter management interfaces or local services; details: Enable detailed logging and review authentication failures, privilege escalation attempts, and configuration changes.