CVE-2025-68404
7.5HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
- Impact
- Full C/I/A compromise
- Weakness
- CWE-367
Impact
Adjacent attackers can compromise system security by exploiting a race condition, requiring specific timing conditions and user interaction. This can lead to a high impact on system confidentiality, integrity, and availability.
Root cause
A time-of-check to time-of-use (TOCTOU) race condition exists within QuRouter processing.
Affected systems
QuRouter versions prior to 2.6.4.001
CVSS v4.0 · CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade QuRouter firmware to version 2.6.4.001 or later. If immediate patching is not possible, restrict local network access to the router management interface.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and later