CVE-2024-13088

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-13088

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

A

n improper authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.5.0.140 and later

References
Link Resource
https://www.qnap.com/en/security-advisory/qsa-25-15 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:qnap:qurouter:2.4.0.190:build_20240522:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.1.172:build_20240606:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.1.634:build_20240710:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.2.317:build_20240903:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.2.538:build_20240923:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.3.103:build_20241011:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.4.106:build_20241017:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.5.032:build_20241029:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.6.028:build_20250207:*:*:*:*:*:*
History

24 Sep 2025, 20:32

Type Values Removed Values Added
CPE cpe:2.3:o:qnap:qurouter:2.4.4.106:build_20241017:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.6.028:build_20250207:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.1.634:build_20240710:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.3.103:build_20241011:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.1.172:build_20240606:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.2.538:build_20240923:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.5.032:build_20241029:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.2.317:build_20240903:*:*:*:*:*:*
cpe:2.3:o:qnap:qurouter:2.4.0.190:build_20240522:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Qnap
Qnap qurouter
References () https://www.qnap.com/en/security-advisory/qsa-25-15 - () https://www.qnap.com/en/security-advisory/qsa-25-15 - Vendor Advisory

09 Jun 2025, 12:15

Type Values Removed Values Added
Summary
  • (es) Se ha reportado una vulnerabilidad de autenticación incorrecta que afecta a QHora. Si un atacante obtiene acceso a la red local, puede explotar la vulnerabilidad para comprometer la seguridad del sistema. Ya hemos corregido la vulnerabilidad en la siguiente versión: QuRouter 2.5.0.140 y posteriores.

06 Jun 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-06 16:15

Updated : 2025-09-24 20:32

NVD link : CVE-2024-13088

Mitre link : CVE-2024-13088

CVE.ORG link : CVE-2024-13088

JSON object : View

Products Affected

qnap

CWE
CWE-287

Improper Authentication