Timing Discrepancy in QNAP QuRouter 2.7.2.113 Exposed Remote Data Leak
CVE-2026-24715 Published on October 15, 2026
Lack of Reproducible Vulnerability Evidence in QNAP Report
An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data.
We have already fixed the vulnerability in the following version:
QuRouter 2.7.2.113 and later
Vulnerability Analysis
Weakness Type
Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. In security-relevant contexts, even small variations in timing can be exploited by attackers to indirectly infer certain details about the product's internal operations. For example, in some cryptographic algorithms, attackers can use timing differences to infer certain properties about a private key, making the key easier to guess. Timing discrepancies effectively form a timing side channel.
Affected Versions
QNAP Systems Inc. QuRouter:- Version 2.7.x and below 2.7.2.113 is affected.