Cyber Resilience

CVE-2025-62844

Qnap Qurouter 2.6.0.239 … 2.6.1.028

Published
20 March 2026
Modified
14 April 2026
Patch / advisory
View advisory
CVSS Score v4 4.0
Click a component to see what it means
Raw vectorCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0020 10th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-62844 is a medium-severity Weak Authentication (CWE-1390) vulnerability in Qnap Qurouter. Its CVSS base score is 4.0 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-5 (Authenticator Management) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A07:2025 Authentication Failures

EU & UK References

Vulnerability Data

A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to gain sensitive information. We have already fixed the vulnerability in the following version: QuRouter 2.6.2.007 and…

more

later

CWE(s)
CWE-1390

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
T1133 External Remote Services Persistence
Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
attack.mitre.org →
Why these techniques?

Weak authentication (CWE-1390) on a network-accessible router service allows use of valid or default credentials (T1078) and external remote services (T1133) to obtain sensitive information from the local network.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-48860Same product: Qnap Qurouter
CVE-2025-62845Same product: Qnap Qurouter
CVE-2024-48861Same product: Qnap Qurouter
CVE-2024-50390Same product: Qnap Qurouter
CVE-2024-13088Same product: Qnap Qurouter
CVE-2025-29887Same product: Qnap Qurouter
CVE-2024-53700Same product: Qnap Qurouter
CVE-2024-13087Same product: Qnap Qurouter
CVE-2024-50389Same product: Qnap Qurouter
CVE-2025-62843Same product: Qnap Qurouter

Affected Assets

qnap
qurouter
2.6.0.239, 2.6.0.688, 2.6.1.028

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • IA-5 Authenticator Management
  • AC-3 Access Enforcement
  • IA-2 Identification and Authentication (Organizational Users)
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 9 hardening rules · 7 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V7.6.1
  • V6.3.6
  • V6.4.2
  • V6.4.4

Mitigating Controls (NIST 800-53 r5) AI

IA-5 Authenticator Management good match
prevent

Directly requires management of authenticator strength, complexity and secure distribution to eliminate weak authentication mechanisms such as those exploited in CVE-2025-62844.

AC-3 Access Enforcement good match
prevent

Enforces approved authentication and access-control policies before any sensitive information can be accessed, blocking the unauthorized disclosure path described in the CVE.

IA-2 Identification and Authentication (Organizational Users) partial match
prevent

Mandates identification and authentication of users prior to system access, directly addressing the weak-authentication flaw that allows local-network information disclosure.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 full match
prevents

Explicitly requires authentication of users/services/hardware with MFA and password-strength controls.

PR.AA-02 mostly match
prevents

Identity proofing and binding is a core prerequisite for non-weak authentication.

PR.AA-01 partial match
prevents

Credential management directly supports stronger authentication but does not guarantee proof of identity.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.5 Secure authentication full match
prevents

Mandating multi-factor and non-password authentication techniques counters the use of inherently weak single-factor or password-only authentication mechanisms.

A.5.17 Authentication information partial match
prevents

Strong-password and non-reuse requirements raise the bar against weak single-factor authentication that can be exploited via guessing or credential stuffing.

Hardening callouts derived

Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).

Ubuntu 22.04 (1 rule)
  • V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. via CWE-1390

References