Authentication Bypass in QNAP QHora‑322 (CVE‑2024‑13088) Allows Unauthorized Access
What It Is – A medium‑severity authentication‑bypass flaw (CVSS 5.0) in the miro_webserver_controllers_api_login_singIn function of QNAP’s QHora‑322 router permits an attacker on the same network segment to log in using any QCloud account without presenting valid credentials.
Exploitability – The vulnerability is exploitable without authentication; no public exploit code is required, but the attack vector is trivial for a network‑adjacent adversary.
Affected Products – QNAP QHora‑322 routers (firmware versions prior to the 2026‑03‑30 security update).
TPRM Impact – Organizations that rely on QNAP QHora‑322 for edge routing, VPN termination, or as a gateway to storage services may face unauthorized device control, potential data leakage, and downstream supply‑chain exposure if the compromised router is used to service third‑party customers.
Recommended Actions –
- Deploy QNAP’s security advisory QSA‑25‑15 firmware update immediately.
- Isolate QHora‑322 devices on a dedicated VLAN and restrict inbound traffic to trusted subnets.
- Enable network‑level monitoring for anomalous API calls to the
login_singInendpoint. - Review and harden any QCloud integration, enforcing MFA where possible.
- Conduct a rapid risk assessment of any downstream services that depend on the affected routers.