CVE-2025-68404

HighCVSS 7.5/10Last modified Oct 19, 2026

Description

A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.

We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and later

Metrics

CVSS 4.0 7.5/10

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-367

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 15, 2026
Last modified: Oct 19, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-684066.5A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit t CVE-2025-68417.2A vulnerability has been found in code-projects Product Inventory System 1.0 and classified as critical. This vulnerability affects unknown CVE-2025-68427.2A vulnerability was found in code-projects Product Inventory System 1.0 and classified as critical. This issue affects some unknown processi CVE-2025-684207.5Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs i CVE-2025-684218.7Comarch ERP Optima client makes use of a hard-coded password for a database user. These credentials cannot be changed. It is possible for a CVE-2025-684224.3Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended CVE-2025-684287.5jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the CVE-2025-684295.3Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions CVE-2025-68439.8A vulnerability was found in code-projects Simple Photo Gallery 1.0. It has been classified as critical. Affected is an unknown function of CVE-2025-684304.3CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.8.1 through 2.52.0, an attacker with a CVE-2025-684317.1libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item p CVE-2025-684327.3Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads Language Server Protoc