TI-2025-38996 Aliases CVE-2025-62843 GHSA-v9ww-wgw5-f4f7

An improper restriction of communication channel to intended endpoints vulnerability has…

LOW 6CWE-923Published 2026-03-20 · Updated 2026-03-25

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, they can then exploit the vulnerability to gain the privileges that were intended for the original endpoint. We have already fixed the vulnerability in the following version: QuRouter 2.6.3.009 and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00298 22nd percentileScored 2026-11-07

Fix Fixed QuRouter (QNAP Systems Inc.): 2.6.3.009

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
QNAP	QuRouter	2.6.x to before 2.6.3.009	2.6.3.009	Patch available	CNA

QuRouter VendorQNAP Affected 2.6.x to before 2.6.3.009 Fixed in 2.6.3.009 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:o:qnap:qurouter:2.6.0.239:build_20250625::::::	2.6.0.239 build_20250625	Vulnerable	QNAP
cpe:2.3:o:qnap:qurouter:2.6.0.688:build_20250818::::::	2.6.0.688 build_20250818	Vulnerable	QNAP
cpe:2.3:o:qnap:qurouter:2.6.1.028:build_20251001::::::	2.6.1.028 build_20251001	Vulnerable	QNAP
cpe:2.3:o:qnap:qurouter:2.6.2.007:build_20251027::::::	2.6.2.007 build_20251027	Vulnerable	QNAP

cpe:2.3:o:qnap:qurouter:2.6.0.239:build_20250625:*:*:*:*:*:* Versions 2.6.0.239 build_20250625 Vulnerable ·QNAP
cpe:2.3:o:qnap:qurouter:2.6.0.688:build_20250818:*:*:*:*:*:* Versions 2.6.0.688 build_20250818 Vulnerable ·QNAP
cpe:2.3:o:qnap:qurouter:2.6.1.028:build_20251001:*:*:*:*:*:* Versions 2.6.1.028 build_20251001 Vulnerable ·QNAP
cpe:2.3:o:qnap:qurouter:2.6.2.007:build_20251027:*:*:*:*:*:* Versions 2.6.2.007 build_20251027 Vulnerable ·QNAP

Remediation

Fix · CNA QuRouter (QNAP Systems Inc.) Fixed in 2.6.3.009

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-03-20
QNAP Systems QuRouter 2.6.3.009
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-38998 An improper neutralization of escape, meta, or control sequences vulnerability has been…Priority LOW 25
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2025-62843
2026-10-03 Alias added: GHSA-v9ww-wgw5-f4f7

References

Advisory 1

https://www.qnap.com/en/security-advisory/qsa-26-12

TI-2024-32560 Command injection in QNAP QuRouter CVSS 4.0CRITICAL 9.5
TI-2024-33824 SQL injection in QNAP QuRouter CVSS 4.0CRITICAL 9.5
TI-2024-33825 OS command injection in QNAP QuRouter CVSS 4.0HIGH 7.7
TI-2025-21275 QuRouter 2.5 CVSS 4.0HIGH 7.1
TI-2024-32561 Command injection in QNAP QuRouter CVSS 4.0HIGH 7.3
TI-2025-38999 SQL injection in QNAP QuRouter CVSS 4.0HIGH 7.3

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences