The vulnerability presents an external control of system or configuration setting flaw that allows a local attacker who has gained administrator privileges on a QuRouter to alter system data. The potential impact is the unauthorized modification of configuration or stored data, which could lead to service disruption or incorrect device behavior if left unaddressed.

QNAP Systems Inc. QuRouter systems running versions earlier than 2.7.2.113 are vulnerable. The fix is available in QuRouter 2.7.2.113 and later.

The CVSS score of 4.6 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers need to have local administrator access to exploit the flaw, and success would allow them to modify data on the device.