CVE-2025-62843
Received Received - Intake
Improper Communication Restriction in QHora Enables Privilege Escalation

Publication date: 2026-03-20

Last updated on: 2026-04-14

Assigner: QNAP Systems, Inc.

Description
An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, they can then exploit the vulnerability to gain the privileges that were intended for the original endpoint. We have already fixed the vulnerability in the following version: QuRouter 2.6.3.009 and later
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-20
Last Modified
2026-04-14
Generated
2026-06-16
AI Q&A
2026-03-20
EPSS Evaluated
2026-06-15
NVD
CVE-2025-62843
EUVD
EUVD-2025-208895
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
qnap qurouter 2.6.0.239
qnap qurouter 2.6.0.688
qnap qurouter 2.6.1.028
qnap qurouter 2.6.2.007
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-923 The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

[{'type': 'paragraph', 'content': "CVE-2025-62843 is a vulnerability in QNAP's QuRouter devices where there is an improper restriction of communication channels to intended endpoints. This means that if an attacker gains physical access to the device, they can exploit this flaw to gain privileges that were originally meant only for the legitimate endpoint."}] [1]

Impact Analysis

[{'type': 'paragraph', 'content': "If exploited, this vulnerability allows an attacker with physical access to the QuRouter device to escalate their privileges beyond what is intended. This could lead to unauthorized control or access to the device's functions and data, potentially compromising the security and integrity of the network managed by the device."}] [1]

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate the vulnerability CVE-2025-62843, you should update the QuRouter firmware to version 2.6.3.009 or later.

The update can be performed via automatic or manual firmware installation as detailed in the security advisory.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-62843. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart