Medium severity · published Mar 20, 2026
CVE-2025-62843
An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, they can then exploit the vulnerability to gain the privileges that were intended for the original endpoint.
We have already fixed the vulnerability in the following version:
QuRouter 2.6.3.009 and later
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QU
Qurouter · Qnap
2.6.0.239; 2.6.0.688; 2.6.1.028; 2.6.2.007 · source: NVD
In the news
VulnerabilityMedium
ZDI-26-237: (Pwn2Own) QNAP QHora-322 ip6_wanifset Improper Restriction of Communication Channel to Intended Endpoints Firewall Bypass Vulnerability
This vulnerability allows network-adjacent attackers to bypass firewall rules on affected installations of QNAP QHora-322 routers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.3. The following CVEs are assigned: CVE-2025-62843.
Mar 30, 2026·Zero Day Initiative
VulnerabilityCritical
QNAP fixed four vulnerabilities demonstrated at Pwn2Own Ireland 2025
QNAP fixed four vulnerabilities shown at Pwn2Own 2025 that could enable code execution, data access, or system disruption. Taiwanese vendor QNAP has addressed multiple vulnerabilities, including four SD-WAN router issues (CVE-2025-62843 to CVE-2025-62846) demonstrated at the Pwn2Own Ireland 2025 by Team DDOS. The team chained multiple bugs in QNAP devices to gain root access and […]
Mar 23, 2026·Security Affairs
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-62843
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-62843
Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-26-12
More from Qurouter
9.8
CVE-2024-50390
A command injection vulnerability has been reported to affect QHora
9.8
CVE-2024-50389
A SQL injection vulnerability has been reported to affect QuRouter
9.8
CVE-2024-48860
An OS command injection vulnerability has been reported to affect several product versions
7.8
CVE-2024-13088
An improper authentication vulnerability has been reported to affect QHora
7.8
CVE-2024-48861
An OS command injection vulnerability has been reported to affect several product versions