A weak authentication vulnerability in QNAP QuRouter allows an attacker who has local network access to obtain sensitive information from the device. The flaw is categorized as CWE-1390, indicating improper handling of authentication credentials that compromises confidentiality. While it does not provide code execution or denial of service capabilities, the exposure of sensitive data can facilitate further compromise of the network or device.

The vulnerability affects QNAP Systems Inc.’s QuRouter product. Affected builds include QuRouter 2.6.0.239, 2.6.0.688, and 2.6.1.028. These versions are listed in the Common Platform Enumeration strings provided.

The CVSS score of 4 denotes moderate severity, and the EPSS score of less than 1% suggests that exploitation likelihood is low. The flaw has not been documented in the CISA Known Exploited Vulnerabilities catalog. According to the description, the attacker must first reach the device over the local network; no remote exploit is mentioned, so the attack vector is inferred to be local. Because the vendor has released a fix in version 2.6.2.007, devices still running earlier builds remain vulnerable until they apply the update.