An observable timing discrepancy vulnerability exists in QNAP QuRouter firmware that can be leveraged by remote attackers to obtain sensitive data. The flaw is identified as a faulty time comparison (CWE‑208), allowing attackers to infer correct values by measuring response timing differences. A successful exploitation would enable a malicious actor to read confidential configuration information or credentials transmitted by the router, thereby compromising data confidentiality.

The affected product is QNAP Systems Inc.’s QuRouter device. All firmware releases preceding QuRouter 2.7.2.113 are vulnerable. Versions 2.7.2.113 and later contain the patch that corrects the timing comparison logic.

The CVSS score of 5.3 categorizes the vulnerability as moderate severity, and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploits. Attackers would need remote network access to the router and would exploit timing variation across multiple requests to deduce secret data. There are no additional environmental prerequisites noted in the CVE description.