« Volver al listado

CVE-2024-13088

Estado: AnalizadaMedia (5.2)—

An improper authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version: QuRouter 2.5.0.140 and later

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Qnap — Qurouter

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-13088",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-13088",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-06T16:19:34.279680Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@qnapsecurity.com.tw",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.2,
          "Automatable": "NOT_DEFINED",
          "attackVector": "PHYSICAL",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@qnapsecurity.com.tw",
      "affectedData": [
        {
          "vendor": "QNAP Systems Inc.",
          "product": "QuRouter",
          "versions": [
            {
              "status": "affected",
              "version": "2.5.x",
              "lessThan": "2.5.0.140",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-06-06T16:15:23.323",
  "references": [
    {
      "url": "https://www.qnap.com/en/security-advisory/qsa-25-15",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@qnapsecurity.com.tw"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@qnapsecurity.com.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nQuRouter 2.5.0.140 and later"
    },
    {
      "lang": "es",
      "value": "Se ha reportado una vulnerabilidad de autenticación incorrecta que afecta a QHora. Si un atacante obtiene acceso a la red local, puede explotar la vulnerabilidad para comprometer la seguridad del sistema. Ya hemos corregido la vulnerabilidad en la siguiente versión: QuRouter 2.5.0.140 y posteriores."
    }
  ],
  "lastModified": "2026-06-17T07:01:09.040",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qurouter:2.4.0.190:build_20240522:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42432B47-A274-4AC7-9E02-0D2D257A6FC5"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qurouter:2.4.1.172:build_20240606:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "77451C56-4576-4CCC-B7FD-7C874F22C3CA"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qurouter:2.4.1.634:build_20240710:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "18080300-EC8D-4F8E-926E-25D0119870AD"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qurouter:2.4.2.317:build_20240903:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B8B0134-D750-4258-A0A1-CDBD90728B01"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qurouter:2.4.2.538:build_20240923:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "128C912D-D659-40A7-A0C1-185552C99CDD"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qurouter:2.4.3.103:build_20241011:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95B7AAFE-A97C-4A81-AA34-D7548CFF4855"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qurouter:2.4.4.106:build_20241017:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38F814E5-382C-4765-93DD-4A17C5BC1820"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qurouter:2.4.5.032:build_20241029:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4700EE7-EE4A-44C6-A907-E38DC9E906B8"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qurouter:2.4.6.028:build_20250207:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10C4DB32-20E2-4672-BCD6-25F91722561A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@qnapsecurity.com.tw"
}