CVE-2026-24715
Received
Received - Intake
Timing Discrepancy in QuRouter Allows Information Disclosure
Vulnerability report for CVE-2026-24715, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-15
Last updated on: 2026-10-15
Assigner: QNAP Systems, Inc.
Description
Description
An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data.
We have already fixed the vulnerability in the following version:
QuRouter 2.7.2.113 and later
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| QNAP | Systems | Inc. QuRouter 2.7.x |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-208 | Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. |
