CVE-2025-68403
Awaiting Analysis Awaiting Analysis - Queue

External Control of System Settings in QuRouter

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: QNAP Systems, Inc.

Description
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2025-68403
EUVD
EUVD-2025-211095

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
QNAP Systems Inc. QuRouter 2.7.x

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-15 One or more system settings or configuration elements can be externally controlled by a user.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an external control of system or configuration setting issue in QuRouter. If an attacker gains administrator access to the system, they can exploit it to modify data on the system.

Detection Guidance

Detection requires checking if QuRouter is running a version prior to 2.7.2.113. Use the command 'qurouter --version' to check the installed version. If the version is below 2.7.2.113, the system is vulnerable.

Impact Analysis

If an attacker exploits this vulnerability, they could alter system data, potentially leading to unauthorized changes, data corruption, or loss of system integrity. This requires the attacker to already have administrator access.

Compliance Impact

The vulnerability allows a local attacker with administrator access to modify system data, which could lead to unauthorized changes in sensitive information. This may impact compliance with GDPR or HIPAA if such modifications affect personal or health data integrity and confidentiality.

Mitigation Strategies

Update QuRouter to version 2.7.2.113 or later to address the vulnerability. Ensure only trusted administrators have access to system accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-68403. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart