CVE-2025-68404— vcs_pentest Race Condition Authentication Bypass Vulnerability in QuRouter management interface
Quick assessment
Affected
QNAP Systems Inc. QuRouter
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
已报告存在一个检查时与使用时的竞争条件（time-of-check time-of-use，简称 TOCTOU）漏洞，会影响 QuRouter。如果该漏洞被利用，远程攻击者可能借此危及系统安全。 我们已在以下版本中修复了该漏洞： QuRouter 2.6.4.001 及更高版本。
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| QNAP Systems Inc. | QuRouter | 2.6.x< 2.6.4.001 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-68404
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
vcs_pentest Race Condition Authentication Bypass Vulnerability in QuRouter management interface
Source: CVE Program / CVE List V5
Vulnerability Description
A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.
We have already fixed the vulnerability in the following version:
QuRouter 2.6.4.001 and later
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
检查时间与使用时间(TOCTOU)的竞争条件
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| QNAP Systems Inc. | QuRouter | 2.6.x ~ 2.6.4.001 | - |
|
II. Public POCs for CVE-2025-68404
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-68404
请登录查看更多情报信息。
Other References for CVE-2025-68404 (1)
Same Patch Batch · QNAP Systems Inc. · 2026-10-15 · 35 CVEs total
| CVE-2026-50612 | 9.4 CRITICAL | Import Symlink Following Remote Code Execution Vulnerability in QuMagie |
| CVE-2026-34006 | 9.3 CRITICAL | Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer |
| CVE-2026-50619 | 9.3 CRITICAL | Unauthenticated remote code execution vulnerability |
| CVE-2026-47786 | 9.3 CRITICAL | Pre-Authentication Command Injection |
| CVE-2026-39997 | 8.9 HIGH | Unauthenticated Remote Input Injection in QNAP HD Station's remotepad |
| CVE-2026-39993 | 8.7 HIGH | Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter |
| CVE-2026-34015 | 8.7 HIGH | Remote Code Execution in upload.php of Video Station |
| CVE-2026-44084 | 8.7 HIGH | Access Code Forgery in Video Station leading to unauthorized media access |
| CVE-2026-53882 | 8.7 HIGH | Path Traversal in Virtualization Station VM Import |
| CVE-2026-41544 | 8.7 HIGH | Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/rena |
| CVE-2026-41545 | 8.6 HIGH | WebSocket timelapse path traversal and command injection |
| CVE-2026-34008 | 8.5 HIGH | **Privilege Escalation** World-writable crontab path monitored and executed by root-owned |
| CVE-2026-34014 | 8.4 HIGH | ds-move-files.sh is writable and executed as root |
| CVE-2026-34009 | 8.4 HIGH | **Container Escape** Host user home directory mounted with write access into application c |
| CVE-2025-66275 | 7.7 HIGH | Remote code execution via command injection |
| CVE-2025-66272 | 7.7 HIGH | Arbitrary file deletion and remote code execution |
| CVE-2026-26243 | 7.2 HIGH | Arbitrary Folder Deletion in Qsync Central 5.0.0.5 |
| CVE-2026-26244 | 7.1 HIGH | SQLi#1 SQL Injection in class_videos.php _getFilters |
| CVE-2026-26245 | 7.1 HIGH | SQLi#2 SQL Injection in class_videos.php getSmartVideosByOffset |
| CVE-2026-34007 | 6.9 MEDIUM | **RCE** Unsanitized `X-Forwarded-For` header passed to `shell_exec()` via broken IP valida |
Showing top 20 of 35 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: QNAP Systems Inc.
-
CVE-2026-50619
Unauthenticated remote code execution vulnerability -
CVE-2026-47790
Privilege Escalation via QuFTP Log-based XSS -
CVE-2026-47786
Pre-Authentication Command Injection -
CVE-2026-39997
Unauthenticated Remote Input Injection in QNAP HD Station's -
CVE-2026-39991
Stored Cross-Site Scripting (XSS) in Note Station file uploa
Same weakness: CWE-367
-
CVE-2026-94621
AliasVault: Server-Side Request Forgery via DNS rebinding in -
CVE-2026-57569
Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due -
CVE-2026-101308
TOCTOU race between sound(4) buffer resizing and mmap -
CVE-2026-102354
BentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS -
CVE-2026-86848
Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing
V. Comments for CVE-2025-68404
No comments yet