An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 20, 2026 · NIST NVD

   Detected

   An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, they can then exploit the vulnerability to gain the privileges that were intended for the original endpoint. We have already fixed the vulnerability in the following version: QuRouter 2.6.3.009 and later

2. Jun 17, 2026 · NIST NVD

   Updated

   An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, they can then exploit the vulnerability to gain the privileges that were intended for the original endpoint. We have already fixed the vulnerability in the following version: QuRouter 2.6.3.009 and later

Affected

• cpe qnap/qurouter2.6.0.239
• cpe qnap/qurouter2.6.0.688
• cpe qnap/qurouter2.6.1.028
• cpe qnap/qurouter2.6.2.007

Sources

• CVE.orgVulnerability recordCVE-2025-62843

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2025-62843

  An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, they can then exploit the vulnerability to gain the privileges that were intended for the original endpoint. We have alre

  nvd.nist.gov

References

• Vendor Advisory · qnap.com