{"id":"CVE-2026-24715","title":"An observable timing discrepancy vulnerability has been reported to affect QuRouter","summary":"An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data.\n\nWe have already fixed the vulnerability in the following version…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":["CWE-208"],"vendor":"QNAP Systems Inc.","product":"QuRouter","affected":["QuRouter >= 2.7.x < 2.7.2.113"],"published":"2026-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T08:16:37.353","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-24715","references":[{"url":"https://www.qnap.com/en/release-notes/qurouter/overview/2.7","label":"security@qnapsecurity.com.tw"}],"tags":["nvd","cve.org"],"cvssSource":"cna","ingestedAt":"2026-10-15T07:57:27.847Z","slug":"CVE-2026-24715","body":"## Overview\n\nAn observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data.\n\nWe have already fixed the vulnerability in the following version:\nQuRouter 2.7.2.113 and later\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":222098,"id":"CVE-2026-24715","ts":1792054751044,"field":"cvss","old":"1.3","new":"5.3"},{"seq":222097,"id":"CVE-2026-24715","ts":1792054751044,"field":"severity","old":"low","new":"medium"}]}