CVE-2025-68403
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. The vulnerability has been fixed in QuRouter 2.7.2.113 and later.
Risk Assessment
A local attacker with an administrator account can modify system data, potentially compromising configuration integrity and enabling further exploitation.
Recommendation
Update QuRouter to version 2.7.2.113 or later and restrict administrative access to trusted individuals.
Other vulnerabilities in QuRouter
See all- CVE-2026-24715Medium
An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data.
- CVE-2025-68404High
A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.
- CVE-2025-29887High
A command injection vulnerability has been reported in QuRouter 2.5.1. A remote attacker who gains an administrator account can exploit it to execute arbitrary commands.
Original NVD description (English source)
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS