{"schemaVersion":3,"id":"CVE-2026-24715","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data.\n\nWe have already fixed the vulnerability in the following version:\nQuRouter 2.7.2.113 and later","dates":{"published":"2026-10-15T06:58:49.678Z","modified":"2026-10-15T18:27:22.934Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":5.3,"severity":"medium","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00189,"percentile":0.08019,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-15T00:00:00.000Z","score":0.00189,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00189,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00189,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00189,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00189,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00189,"percentile":0.08019}],"last30":[{"date":"2026-10-15T00:00:00.000Z","score":0.00189,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00189,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00189,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00189,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00189,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00189,"percentile":0.08019}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-208","name":"Observable Timing Discrepancy","description":"Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/208.html"}],"affected":[{"vendor":"qnap systems inc.","product":"qurouter","name":"QuRouter","label":"qurouter","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.7.x, < 2.7.2.113","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.7.x, < 2.7.2.113","eol":null,"hubHref":"/vendor/qnap_systems_inc/qurouter"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.qnap.com/en/release-notes/qurouter/overview/2.7","label":"www.qnap.com/en/release-notes/qurouter/overview/2.7","hostname":"www.qnap.com","tags":["Release Notes"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-15T06:58:49.678Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-15T18:27:22.934Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":21,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T02:18:07.657Z","stale":false,"partial":false}}