Read the docs
TI-2024-12136 Aliases CVE-2024-13088GHSA-8m5f-fx5r-2p23

Improper authentication in QNAP QuRouter

Priority LOW 23CWE-287Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

An improper authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.5.0.140 and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00276 20th percentileScored 2026-11-07
Fix Fixed QuRouter (QNAP Systems Inc.): 2.5.0.140

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQuRouter2.5.x to before 2.5.0.1402.5.0.140Patch availableCNA
  • QuRouter VendorQNAP Affected 2.5.x to before 2.5.0.140 Fixed in 2.5.0.140 Patch available CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qurouter:2.4.0.190:build_20240522:*:*:*:*:*:*2.4.0.190 build_20240522VulnerableQNAP
cpe:2.3:o:qnap:qurouter:2.4.1.172:build_20240606:*:*:*:*:*:*2.4.1.172 build_20240606VulnerableQNAP
cpe:2.3:o:qnap:qurouter:2.4.1.634:build_20240710:*:*:*:*:*:*2.4.1.634 build_20240710VulnerableQNAP
cpe:2.3:o:qnap:qurouter:2.4.2.317:build_20240903:*:*:*:*:*:*2.4.2.317 build_20240903VulnerableQNAP
cpe:2.3:o:qnap:qurouter:2.4.2.538:build_20240923:*:*:*:*:*:*2.4.2.538 build_20240923VulnerableQNAP
cpe:2.3:o:qnap:qurouter:2.4.3.103:build_20241011:*:*:*:*:*:*2.4.3.103 build_20241011VulnerableQNAP
cpe:2.3:o:qnap:qurouter:2.4.4.106:build_20241017:*:*:*:*:*:*2.4.4.106 build_20241017VulnerableQNAP
cpe:2.3:o:qnap:qurouter:2.4.5.032:build_20241029:*:*:*:*:*:*2.4.5.032 build_20241029VulnerableQNAP
cpe:2.3:o:qnap:qurouter:2.4.6.028:build_20250207:*:*:*:*:*:*2.4.6.028 build_20250207VulnerableQNAP
  • cpe:2.3:o:qnap:qurouter:2.4.0.190:build_20240522:*:*:*:*:*:* Versions 2.4.0.190 build_20240522 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qurouter:2.4.1.172:build_20240606:*:*:*:*:*:* Versions 2.4.1.172 build_20240606 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qurouter:2.4.1.634:build_20240710:*:*:*:*:*:* Versions 2.4.1.634 build_20240710 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qurouter:2.4.2.317:build_20240903:*:*:*:*:*:* Versions 2.4.2.317 build_20240903 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qurouter:2.4.2.538:build_20240923:*:*:*:*:*:* Versions 2.4.2.538 build_20240923 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qurouter:2.4.3.103:build_20241011:*:*:*:*:*:* Versions 2.4.3.103 build_20241011 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qurouter:2.4.4.106:build_20241017:*:*:*:*:*:* Versions 2.4.4.106 build_20241017 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qurouter:2.4.5.032:build_20241029:*:*:*:*:*:* Versions 2.4.5.032 build_20241029 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qurouter:2.4.6.028:build_20250207:*:*:*:*:*:* Versions 2.4.6.028 build_20250207 Vulnerable ·QNAP

Remediation

  • Fix · CNA QuRouter (QNAP Systems Inc.) Fixed in 2.5.0.140

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-13088
  2. 2026-10-03 Alias added: GHSA-8m5f-fx5r-2p23

References

Advisory 1

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences