CVE-2026-41037

Received Received - Intake

Command Injection in Quantum Networks Router CLI Enables Root RCE

Publication date: 2026-04-21

Last updated on: 2026-05-06

Assigner: Indian Computer Emergency Response Team (CERT-In)

Description

This vulnerability exists in Quantum Networks router due to missing rate limiting and CAPTCHA protection for failed login attempts in the web-based management interface. An attacker on the same network could exploit this vulnerability by performing brute force attacks against administrative credentials, leading to unauthorized access with root privileges on the targeted device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-21

Last Modified

2026-05-06

Generated

2026-07-06

AI Q&A

2026-04-21

EPSS Evaluated

2026-07-05

NVD

CVE-2026-41037

EUVD

EUVD-2026-24079

Affected Vendors & Products

Vendor	Product	Version / Range
qntmnet	qn-i-470_firmware	6.1.1.b1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Quantum Networks router due to inadequate sanitization of user-supplied input in the management CLI interface.

An authenticated remote attacker could exploit this vulnerability by injecting arbitrary operating system commands on the targeted device.

Impact Analysis

Successful exploitation of this vulnerability could allow the attacker to perform remote code execution with root privileges on the targeted device.

Compliance Impact

This vulnerability allows an attacker to perform brute force attacks on administrative credentials, potentially leading to unauthorized root access on the device.

Such unauthorized access could result in compromised confidentiality, integrity, and availability of data managed by the device.

Therefore, this vulnerability may negatively impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and secure access controls.

Hi! I’m here to help you understand CVE-2026-41037. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70