CVE-2026-24715
Received Received - Intake

Timing Discrepancy in QuRouter Allows Information Disclosure

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: QNAP Systems, Inc.

Description
An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-24715
EUVD
EUVD-2026-101873

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
QNAP Systems Inc. QuRouter 2.7.x

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-208 Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an observable timing discrepancy vulnerability in QuRouter. It allows remote attackers to potentially obtain sensitive data by measuring the time it takes for the system to respond to certain requests.

Detection Guidance

This vulnerability is a timing discrepancy issue in QuRouter. Detection may require network monitoring tools to analyze response times for suspicious patterns. Check if your QuRouter version is below 2.7.2.113. If so, update immediately. No specific commands are provided in the context.

Impact Analysis

If exploited, attackers could gain access to sensitive information through timing analysis. This could lead to data breaches, unauthorized access to confidential data, or further exploitation of the system.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by enabling unauthorized access to sensitive personal or health data, potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Update QuRouter to version 2.7.2.113 or later to address the timing discrepancy vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24715. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart