CVE-2025-62843

Published Mar 20, 2026

Last updated a month ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-62843 is an improper restriction of communication channel to intended endpoints vulnerability that affects QNAP QHora devices. This flaw allows an attacker who has gained physical access to the device to exploit it and obtain privileges that were intended for other endpoints, effectively bypassing existing controls. This vulnerability was one of four security defects (CVE-2025-62843 to CVE-2025-62846) impacting QNAP's SD-WAN routers that were demonstrated at Pwn2Own Ireland 2025. QNAP has since addressed this issue in QuRouter version 2.6.3.009 and later.

Description: An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, they can then exploit the vulnerability to gain the privileges that were intended for the original endpoint. We have already fixed the vulnerability in the following version: QuRouter 2.6.3.009 and later
Source: security@qnapsecurity.com.tw
NVD status: Analyzed
Products: qurouter

Risk scores

CVSS 4.0

Type: Secondary
Base score: 0.9
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: LOW

CVSS 3.1

Type: Primary
Base score: 6.8
Impact score: 5.9
Exploitability score: 0.9
Vector string: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: MEDIUM

Weaknesses

security@qnapsecurity.com.tw: CWE-923

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:qnap:qurouter:2.6.0.239:build_20250625:*:*:*:*:*:*",
            "matchCriteriaId": "6BEA7459-EA28-4A5F-ABB4-F00661760FA4",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:qnap:qurouter:2.6.0.688:build_20250818:*:*:*:*:*:*",
            "matchCriteriaId": "71BB01EA-6A7B-46CF-A2F7-41DDBA5A17ED",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:qnap:qurouter:2.6.1.028:build_20251001:*:*:*:*:*:*",
            "matchCriteriaId": "F61A82A3-3A3E-42B6-B7F6-B5FAF37CCC80",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:qnap:qurouter:2.6.2.007:build_20251027:*:*:*:*:*:*",
            "matchCriteriaId": "DC28FAFD-B2EB-4DB5-B438-A439D4305A5F",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.