CVE-2025-62844

A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to gain sensitive information. We have already fixed the vulnerability in the following version: QuRouter 2.6.2.007 and later

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.qnap.com/en/security-advisory/qsa-26-12	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:qnap:qurouter:2.6.0.239:build_20250625::::::
	cpe:2.3:o:qnap:qurouter:2.6.0.688:build_20250818::::::
	cpe:2.3:o:qnap:qurouter:2.6.1.028:build_20251001::::::

History

14 Apr 2026, 14:24

Type	Values Removed	Values Added
Summary		(es) Se ha reportado una vulnerabilidad de autenticación débil que afecta a QHora. Si un atacante obtiene acceso a la red local, puede entonces explotar la vulnerabilidad para obtener información sensible. Ya hemos corregido la vulnerabilidad en la siguiente versión: QuRouter 2.6.2.007 y posteriores
First Time		Qnap Qnap qurouter
References	~~() https://www.qnap.com/en/security-advisory/qsa-26-12 -~~	() https://www.qnap.com/en/security-advisory/qsa-26-12 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
CPE		cpe:2.3:o:qnap:qurouter:2.6.0.688:build_20250818:::::: cpe:2.3:o:qnap:qurouter:2.6.1.028:build_20251001:::::: cpe:2.3:o:qnap:qurouter:2.6.0.239:build_20250625::::::

20 Mar 2026, 17:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-20 17:16

Updated : 2026-06-17 09:52

NVD link : CVE-2025-62844

Mitre link : CVE-2025-62844

CVE.ORG link : CVE-2025-62844

JSON object : View

Products Affected

qnap

qurouter

CWE

CWE-1390

Weak Authentication

{"id": "CVE-2025-62844", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62844", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-25T14:01:43.911176Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security@qnapsecurity.com.tw", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.0, "Automatable": "NOT_DEFINED", "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@qnapsecurity.com.tw", "affectedData": [{"vendor": "QNAP Systems Inc.", "product": "QuRouter", "versions": [{"status": "affected", "version": "2.6.x", "lessThan": "2.6.2.007", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-03-20T17:16:42.387", "references": [{"url": "https://www.qnap.com/en/security-advisory/qsa-26-12", "tags": ["Vendor Advisory"], "source": "security@qnapsecurity.com.tw"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@qnapsecurity.com.tw", "description": [{"lang": "en", "value": "CWE-1390"}]}], "descriptions": [{"lang": "en", "value": "A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to gain sensitive information.\n\nWe have already fixed the vulnerability in the following version:\nQuRouter 2.6.2.007 and later"}, {"lang": "es", "value": "Se ha reportado una vulnerabilidad de autenticaci\u00f3n d\u00e9bil que afecta a QHora. Si un atacante obtiene acceso a la red local, puede entonces explotar la vulnerabilidad para obtener informaci\u00f3n sensible.\n\nYa hemos corregido la vulnerabilidad en la siguiente versi\u00f3n:\nQuRouter 2.6.2.007 y posteriores"}], "lastModified": "2026-06-17T09:52:31.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qurouter:2.6.0.239:build_20250625:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6BEA7459-EA28-4A5F-ABB4-F00661760FA4"}, {"criteria": "cpe:2.3:o:qnap:qurouter:2.6.0.688:build_20250818:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "71BB01EA-6A7B-46CF-A2F7-41DDBA5A17ED"}, {"criteria": "cpe:2.3:o:qnap:qurouter:2.6.1.028:build_20251001:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F61A82A3-3A3E-42B6-B7F6-B5FAF37CCC80"}], "operator": "OR"}]}], "sourceIdentifier": "security@qnapsecurity.com.tw"}