CVE-2025-68404
Received Received - Intake

Time-of-Check Time-of-Use Race Condition in QuRouter

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: QNAP Systems, Inc.

Description
A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and later

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2025-68404
EUVD
EUVD-2025-211096

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
QNAP Systems Inc. QuRouter 2.6.x

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a time-of-check time-of-use (TOCTOU) race condition vulnerability in QuRouter. It occurs when a system checks a condition and then uses the result of that check, but the condition changes between the check and the use. Attackers could exploit this to bypass security measures and compromise the system.

Detection Guidance

Detection of this TOCTOU race condition vulnerability in QuRouter requires checking the installed version against the fixed release. Use the QuRouter admin interface or CLI to verify if the version is 2.6.4.001 or later. No specific commands are provided in the context for direct detection.

Impact Analysis

If exploited, remote attackers could gain unauthorized access to the system, potentially leading to data breaches, system manipulation, or other malicious activities. Users running affected versions of QuRouter are at risk until they update to version 2.6.4.001 or later.

Compliance Impact

The vulnerability is a time-of-check time-of-use (TOCTOU) race condition that could allow remote attackers to compromise system security. This type of vulnerability may lead to unauthorized access or data breaches, which could negatively impact compliance with standards like GDPR or HIPAA by exposing sensitive data or failing to maintain system integrity.

Mitigation Strategies

Immediately update QuRouter to version 2.6.4.001 or later to address the vulnerability. If updating is not immediately possible, isolate the affected system from untrusted networks to reduce exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-68404. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart