QHora Weak Auth Vulnerability (QuRouter <2.6.2.007), fixed 2.6.2.007
CVE-2025-62844 Published on March 20, 2026

QuRouter
A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to gain sensitive information. We have already fixed the vulnerability in the following version: QuRouter 2.6.2.007 and later

NVD

Vulnerability Analysis

CVE-2025-62844 is exploitable with physical access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
PHYSICAL
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE

Weakness Type

CWE-1390

Affected Versions

QNAP Systems Inc. QuRouter:

Exploit Probability

EPSS
0.20%
Percentile
9.78%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.