CVE-2026-24715

MediumCVSS 5.3/10Last modified Oct 15, 2026

Description

An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data.

We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later

Metrics

CVSS 4.0 5.3/10CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-208

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 15, 2026
Last modified
Oct 15, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-247167.2A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an aCVE-2026-247176.5A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administratCVE-2026-247185.3A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit tCVE-2026-247197.2A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administCVE-2026-24728.1Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versiCVE-2026-247206.5An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 6. If a remote attacker gainsCVE-2026-247216.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can theCVE-2026-247226.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can theCVE-2026-247236.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can theCVE-2026-247248.1An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can theCVE-2026-247279.3An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training ManagemenCVE-2026-247289.3A missing authentication for critical function vulnerability in the /servlet/baServer3 endpoint of Interinfo DreamMaker versions before 2025
CVE-2026-24715: Medium severity, CVSS 5.3 | Vulnix