EUVD-2025-211095
GHSA-r46j-qxwq-924p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local admin account on QuRouter
-
ExploitAccess affected config-control function
-
ImpactModify protected system/configuration data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration Configuration hardening
|
| Exploitation Conditions | Exploitation requires that the attacker has already gained a QuRouter administrator account and has local access to the device (AV:L/PR:H); only then can they abuse the external-control-of-configuration flaw (CWE-15) to modify protected system or configuration data. This is strictly bounded: there is no remote vector, no unauthenticated path, and no exploitation possible without pre-existing administrative control, so a non-admin or network-only attacker cannot trigger it. Devices updated to QuRouter 2.7.2.113 or later are not affected. |
| Impact | All available signals point to very low real-world risk. The vendor (QNAP) CVSS 4.0 score is 1.0 with vector AV:L/AC:L/AT:N/PR:H/UI:N and only a low integrity impact (VI:L), with no confidentiality (VC:N) or availability (VA:N) impact and no scope change to subsequent systems. The attack is local (AV:L) and requires high privileges (PR:H) - specifically an already-compromised administrator account per the description - which means the attacker must already possess substantial control before the flaw adds any value. The exploit-maturity metric is E:U (unreported/unproven), and there is no CISA KEV listing, no EPSS data provided, and no public proof-of-concept. There is no conflict among the signals: a low CVSS, no exploitation evidence, and an administrator-only precondition all agree this is a defense-in-depth hardening fix rather than an actionable priority. One metadata inconsistency to verify: the sole tag is 'Information Disclosure', yet the CVSS vector records VI:L (integrity) with VC:N (no confidentiality) and CWE-15 concerns configuration-setting modification - so this is an integrity/data-modification issue, not information disclosure. |
| Exploit ScenarioDerived | An attacker who has already obtained an administrator account on a QuRouter device (via prior compromise, credential theft, or insider access) uses that elevated local access to alter protected system or configuration settings they should not be able to control. No public exploit code or active exploitation has been identified; the flaw only extends what an already-privileged administrator can tamper with. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Modification of protected system or configuration data in QNAP QuRouter is possible when a local attacker who already holds a QuRouter administrator account abuses an external-control-of-configuration flaw (CWE-15). This is an authenticated, local-only issue with low integrity impact and no confidentiality or availability impact; there is no remote or unauthenticated path. QNAP fixed it in QuRouter 2.7.2.113 and later, and no public exploit code has been identified at time of analysis.
RemediationAI
Vendor-released patch: update QuRouter to version 2.7.2.113 or later, available through QNAP's release notes and product download channels (https://www.qnap.com/en/release-notes/qurouter/overview/2.7). No vendor workaround is documented, and because exploitation requires a pre-existing administrator account with local access, the most effective compensating controls are administrative: enforce the principle of least privilege for QuRouter admin accounts, disable or remove unused admin users, use unique strong credentials, and enable multi-factor authentication if the device supports it. Trade-offs: restricting admin access may reduce operational flexibility for legitimate device management, and enabling additional authentication or audit logging can add login friction and storage overhead. Detect potential abuse by auditing for unexpected changes to system or configuration data, and monitor for anomalies; do not rely on network segmentation alone, since the vector is local. No public exploit code has been identified at time of analysis, but patching remains the primary action.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-15 (External Control of System or Configuration Setting) occurs when a product allows a configuration setting or system parameter to be influenced by a source that should not control it, such as an environment variable, configuration file, or other input that an attacker can manipulate. In CVE-2025-68403, the attacker must already possess a QuRouter administrator account and have local access to the device, as reflected in the CVSS vectors: the independent assessment uses AV:L/PR:H/UI:N and the vendor-issued CVSS 4.0 vector carries AV:L/PR:H/UI:N with E:U (exploitation unproven) and only VI:L (low integrity impact). No confidentiality or availability impact is scored, and scope is unchanged. The high privilege requirement and local attack vector mean a network-only or unauthenticated attacker cannot trigger the flaw; the practical effect is limited to an admin modifying data the system should otherwise protect.
Know when Qnap gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Local admin account is a prerequisite so AV:L and PR:H; low complexity, only a low integrity impact from modifying config data, no confidentiality or availability effect.
Primary rating from Vendor (qnapsecurity).
CVSS VectorVendor: qnapsecurity
Lifecycle Timeline
3DescriptionCVE.org
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system.
We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated criti
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticate
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. R
Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. Rated cr
This external control of file name or path vulnerability allows remote attackers to access or modify system files. Rated
Exploit-DB