CVE-2025-68403: Inadequate Steps to Confirm Vulnerability in QuRouter

Q: Which systems are affected?

QuRouter versions earlier than 2.7.2.113 are affected. The issue is fixed in QuRouter 2.7.2.113 and later.

Q: What access does an attacker need to exploit this issue?

The attacker must be local and must first obtain an administrator account. With that access, they can modify data on the system.

Q: What should be done if a device is running an affected version?

Upgrade QuRouter to version 2.7.2.113 or later. Until upgrading, restrict local access and protect administrator accounts because exploitation requires local administrator access.

Published Oct 15, 2026

Updated

An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system.

We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later

Affected Software

1 affected component

QNAP Qurouter<2.7.2.113

Event History

Oct 15, 2026

CVE Published

via MITRE·06:58 AM

Data Sourced

via MITRE·06:58 AM

RemedyDescriptionWeakness

Frequently Asked Questions

Which systems are affected?

QuRouter versions earlier than 2.7.2.113 are affected. The issue is fixed in QuRouter 2.7.2.113 and later.

What access does an attacker need to exploit this issue?

The attacker must be local and must first obtain an administrator account. With that access, they can modify data on the system.

What should be done if a device is running an affected version?

Upgrade QuRouter to version 2.7.2.113 or later. Until upgrading, restrict local access and protect administrator accounts because exploitation requires local administrator access.