CVE-2026-24715: Lack of Reproducible Vulnerability Evidence in QNAP Report

Q: Which QuRouter deployments are affected?

QuRouter versions earlier than 2.7.2.113 are affected. QNAP states that the issue is fixed in QuRouter 2.7.2.113 and later.

Q: Can this be exploited remotely, and what could it expose?

Yes. The report describes the issue as exploitable by remote attackers and states that successful exploitation could allow access to sensitive data.

Q: What is the recommended remediation?

Upgrade QuRouter to version 2.7.2.113 or later. The provided information does not specify a workaround or compensating control for systems that cannot yet be updated.

Published Oct 15, 2026

Updated

An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data.

We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later

Affected Software

1 affected component

QNAP Qurouter<2.7.2.113

Event History

Oct 15, 2026

CVE Published

via MITRE·06:58 AM

Data Sourced

via MITRE·06:58 AM

RemedyDescriptionWeakness

Frequently Asked Questions

Which QuRouter deployments are affected?

QuRouter versions earlier than 2.7.2.113 are affected. QNAP states that the issue is fixed in QuRouter 2.7.2.113 and later.

Can this be exploited remotely, and what could it expose?

Yes. The report describes the issue as exploitable by remote attackers and states that successful exploitation could allow access to sensitive data.

What is the recommended remediation?

Upgrade QuRouter to version 2.7.2.113 or later. The provided information does not specify a workaround or compensating control for systems that cannot yet be updated.