External Control of System Setting Vulnerability in QuRouter by QNAP
CVE-2025-68403

4.6MEDIUM

Key Information:

Vendor

QNAP
Status
Qurouter
Vendor
CVE Published:
15 October 2026

What is CVE-2025-68403?

An external control of system or configuration setting vulnerability has been identified in QuRouter. This flaw allows a local attacker with administrator access to manipulate sensitive data on the system, potentially leading to unauthorized changes. It is crucial to update to QuRouter version 2.7.2.113 or later to ensure system integrity and security.

Affected Version(s)

QuRouter 2.7.x < 2.7.2.113

References

https://www.qnap.com/en/release-notes/qurouter/overview/2.7
release-notes

CVSS V4

Score:
4.6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

蒲宗賢
.