CVE-2024-13088: QNAP QHora Auth Bypass Vulnerability

CVE-2024-13088 Overview

CVE-2024-13088 is an improper authentication vulnerability [CWE-287] affecting QNAP QuRouter firmware running on QHora series routers. An attacker with local network access can exploit the flaw to compromise the security of the device.

QNAP disclosed the issue in security advisory QSA-25-15 and released a fix in QuRouter 2.5.0.140 and later. The CVSS 4.0 vector indicates a physical attack vector requiring user interaction, with high impact to confidentiality and limited impact to integrity and availability.

Critical Impact
Successful exploitation allows an adjacent attacker to bypass authentication controls on the router and access sensitive configuration or data that should require authenticated access.

Affected Products

QNAP QuRouter versions prior to 2.5.0.140 running on QHora series devices
Confirmed affected builds include 2.4.0.190, 2.4.1.172, 2.4.1.634, 2.4.2.317, 2.4.2.538, 2.4.3.103, 2.4.4.106, 2.4.5.032
QuRouter 2.4.6.028 build 20250207 and earlier releases in the 2.4.x branch

Discovery Timeline

2025-06-06 - CVE-2024-13088 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13088

Vulnerability Analysis

The flaw is classified as improper authentication [CWE-287] in the QuRouter firmware that powers QNAP QHora routers. Authentication controls do not correctly verify the identity of a requester under specific conditions reachable from the local network. An attacker who has already obtained a foothold on the same network segment as the router can leverage this weakness to interact with functionality that should be restricted to authenticated administrators.

The CVSS 4.0 metrics indicate exploitation requires physical or adjacent access and passive user interaction, but that a successful attack yields high confidentiality impact. Integrity and availability impact are limited, suggesting the primary risk is unauthorized disclosure of router configuration, credentials, or traffic metadata rather than full device takeover.

Root Cause

QNAP has not published detailed technical root-cause information beyond the advisory description. The CWE-287 classification indicates the authentication routine either accepts requests without valid credentials or trusts a caller-supplied assertion of identity. The fix shipped in QuRouter 2.5.0.140 corrects the authentication logic.

Attack Vector

Exploitation requires the attacker to reach the router across the local network, typically from a compromised endpoint, a rogue wireless client, or a device on the LAN or management VLAN. The attacker then issues crafted requests to the router's management interface to trigger the authentication weakness. Because QHora routers are frequently deployed at the network perimeter of small offices and homes, an attacker who compromises any client device can pivot to the router itself.

No public proof-of-concept, exploit code, or evidence of in-the-wild exploitation is currently available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the QNAP Security Advisory QSA-25-15 for the vendor's technical description.

Detection Methods for CVE-2024-13088

Indicators of Compromise

Unexpected administrative sessions or configuration changes on the QHora router originating from LAN addresses
New or modified port forwarding, DNS, VPN, or firewall rules that were not initiated by an administrator
Router log entries showing successful API or management-plane access without a preceding authentication event

Detection Strategies

Compare the running QuRouter firmware version against 2.5.0.140; anything earlier in the 2.4.x branch is vulnerable
Baseline the router's configuration and periodically diff it to detect unauthorized changes
Inspect local network traffic for unauthenticated HTTP or API requests directed at the router management interface

Monitoring Recommendations

Forward QHora syslog output to a central log collector and alert on administrative actions outside change windows
Monitor DHCP and ARP tables for unexpected devices on management VLANs that could reach the router
Track outbound connections from the router to non-QNAP infrastructure that may indicate tampering with DNS or VPN settings

How to Mitigate CVE-2024-13088

Immediate Actions Required

Upgrade QuRouter firmware to 2.5.0.140 or later on all QHora devices
Rotate administrator passwords and any pre-shared keys stored on the router after patching
Review router configuration for unauthorized changes made prior to the update

Patch Information

QNAP fixed the vulnerability in QuRouter 2.5.0.140 and later. Administrators can apply the update through the QuRouter web interface under the firmware update section, or by downloading the release from QNAP's support portal. Full details are in the QNAP Security Advisory QSA-25-15.

Workarounds

Restrict access to the router management interface to a dedicated management VLAN or a small set of trusted administrative hosts
Disable remote management features that are not strictly required and enforce strong, unique administrator credentials
Segment untrusted client devices, including guest Wi-Fi and IoT endpoints, away from the router management network

bash

# Verify installed QuRouter firmware version and confirm it is 2.5.0.140 or later
# Run from the QuRouter administrative shell or check the web UI under System > Firmware Update
getcfg System Version