QuRouter External System Setting Control Vulnerability <2.7.2.113
CVE-2025-68403 Published on October 15, 2026
Inadequate Steps to Confirm Vulnerability in QuRouter
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system.
We have already fixed the vulnerability in the following version:
QuRouter 2.7.2.113 and later
Vulnerability Analysis
CVE-2025-68403 can be exploited with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
External Control of System or Configuration Setting
One or more system settings or configuration elements can be externally controlled by a user. Allowing external control of system settings can disrupt service or cause an application to behave in unexpected, and potentially malicious ways.
Affected Versions
QNAP Systems Inc. QuRouter:- Version 2.7.x and below 2.7.2.113 is affected.