Improper IPv6 Firewall Bypass in QNAP QHora‑322 (CVE‑2025‑62843) Enables Network‑Adjacent Attack
What It Is — The vulnerability (CVE‑2025‑62843) in QNAP’s QHora‑322 router fails to enforce IPv6 firewall rules on PPPoE interfaces, allowing unauthenticated, network‑adjacent attackers to bypass the device’s firewall. When chained with other flaws, it can lead to root‑level code execution.
Exploitability — No public exploit code is available, but the advisory confirms the flaw is trivially exploitable without credentials. CVSS 3.1 base score 6.3 (Moderate).
Affected Products — QNAP QHora‑322 routers (all firmware versions prior to the March 2026 security update).
TPRM Impact — Suppliers that embed QHora‑322 in managed services or provide it to customers become a potential weak link in the supply chain. A compromised router can expose internal IPv6 traffic, undermine segmentation, and serve as a foothold for lateral movement into downstream environments.
Recommended Actions —
- Deploy QNAP’s March 2026 firmware patch (QSA‑26‑12) immediately.
- Verify that IPv6 firewall rules are correctly applied on PPPoE interfaces after patching.
- Conduct a network scan for any QHora‑322 devices still running vulnerable firmware.
- Review segmentation and monitoring policies for IPv6 traffic originating from edge routers.
- Include QNAP router patch status in third‑party risk assessments and vendor questionnaires.