Authentication Bypass in QNAP QHora‑322 (CVE‑2025‑62844) Enables Remote Access

Authentication Bypass in QNAP QHora‑322 (CVE‑2025‑62844) Enables Remote Access

What It Is — A remote authentication‑bypass flaw in QNAP’s QHora‑322 routers that lets an attacker reach the device without valid credentials by abusing the login.newAuthMiddleware.Authenticator endpoint. The issue is tracked as CVE‑2025‑62844 and carries a CVSS 5.6 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).

Exploitability — No public exploit code has been released, but the vulnerability can be triggered remotely with no authentication required, making it easy to weaponize. No confirmed wild‑use yet, but the low complexity warrants immediate mitigation.

Affected Products — QNAP QHora‑322 network routers running firmware versions prior to the March 2026 security update (QSA‑26‑12).

TPRM Impact — Organizations that rely on QNAP routers as part of their infrastructure‑as‑a‑service, managed‑service offerings, or on‑premise networking face a realistic risk of unauthorized device control. An attacker who gains access could pivot to downstream systems, exfiltrate data, or deploy ransomware, amplifying supply‑chain exposure.

Recommended Actions —

• Apply QNAP’s March 2026 firmware patch (QSA‑26‑12) immediately.
• Block external access to the login.newAuthMiddleware.Authenticator endpoint via firewall or ACLs.
• Conduct an inventory of all QHora‑322 units and verify they are running the patched firmware.
• Review router logs for suspicious qurouter_token usage and anomalous login attempts.
• Update third‑party risk registers and vendor assessments to reflect the new vulnerability status.

Source: Zero Day Initiative Advisory ZDI‑26‑239