Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, they can then exploit the vulnerability to gain the privileges that were intended for the original endpoint. We have already fixed the vulnerability in the following version: QuRouter 2.6.3.009 and later
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
4 versions affected across 1 product
| Date | Total | Labels |
|---|
| 2026-03-22 | 2 | Disclosure1General1 |
| 2026-03-23 | 1 | Patch1 |
| 2026-03-24 | 1 | Patch1 |
| 2026-03-29 | 1 | Patch1 |
QNAP patches vulnerabilities CVE-2025-62843 to CVE-2025-62846 https://hostingtech.net/qnap-patches-vulnerabilities-cve-2025-62843-to-cve-2025-62846/ via @HostingTech https://t.co/g75JBxNaqm
Post summary
QNAP has released patches for CVE-2025-62843 through CVE-2025-62846, as reported by @HostingTech.
QNAP patches four SD-WAN router flaws (CVE-2025-62843 through 62846) chained at Pwn2Own Ireland for root access - earned Team DDOS $100K. Update QuRouter to 2.6.3.009. Physical, LAN, and authenticated vectors all covered. https://securityaffairs.com/189871/security/qnap-fixed-four-vulnerabilities-demonstrated-at-pwn2own-ireland-2025.html #infosec #QNAP #Pwn2Own
Post summary
QNAP releases a patch for four SD‑WAN router vulnerabilities demonstrated at Pwn2Own Ireland, urging users to update to QuRouter version 2.6.3.009 to secure all physical, LAN, and authenticated vectors.
QNAP patches critical vulnerabilities including four SD-WAN router bugs showcased at Pwn2Own Ireland 2025 (CVE-2025-62843 to CVE-2025-62846). Fixes cover QuNetSwitch and QVR Pro. #QNAPSecurity #SDWAN #Ireland https://ift.tt/GW4BN0i
Post summary
QNAP released patches for four critical SD‑WAN router CVEs highlighted at Pwn2Own Ireland 2025, but the post does not include proof of concept details, exploit code, or evidence of active exploitation.
🚨*CVE* CVE-2025-62843 An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, they can… https://www.cve.org/CVERecord?id=CVE-2025-62843 ----- Traducción: CVE-2025-62843 Una… http://infoflow.cloud`
Post summary
The text is a succinct disclosure of CVE‑2025‑62843 affecting QHora, offering minimal technical description and a link to the CVE record without indicating exploitation, patching, or a PoC.
CVE-2025-62843 An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, they can… https://www.cve.org/CVERecord?id=CVE-2025-62843
Post summary
A new CVE affecting QHora is reported, describing an improper restriction of communication channel to intended endpoints; no evidence of exploitation, PoC, or patch is disclosed.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | qnap | qurouter | 2.6.0.239 | - | - |
| OS | qnap | qurouter | 2.6.0.688 | - | - |
| OS | qnap | qurouter | 2.6.1.028 | - | - |
| OS | qnap | qurouter | 2.6.2.007 | - | - |