A time‑of‑check time‑of‑use race condition in QuRouter’s management interface can be triggered by remote attackers. By exploiting the race, an attacker can bypass authentication mechanisms and gain unauthorized access to the device. The vulnerability is classified as CWE‑367 and, if successful, would compromise the confidentiality, integrity, and availability of the system.

The flaw affects QNAP Systems Inc. QuRouter devices. Any device running a firmware version prior to 2.6.4.001 is vulnerable. Versions 2.6.4.001 and later contain the fix.

The CVSS score of 7.5 indicates a high severity. The EPSS score is less than 1%, suggesting a very low probability of exploitation currently. The vulnerability is not listed in CISA’s KEV catalog, but because the attack vector is remote and the impact is full authentication bypass, administrators should consider it a high‑risk issue pending an update. The attack likely requires the attacker to send specially crafted requests to the management interface before authentication is finalized, taking advantage of the race condition identified in the flaw description.