CVE Explorer

CVE-2026-41039

This vulnerability exists in Quantum Networks router due to improper access control and insecure default configuration in the web-based management interface. An unauthenticated attacker could exploit this vulnerability by accessing exposed API endpoints on the targeted device. Successful exploitation of this vulnerability could allow the attacker to access sensitive information, including internal endpoints, scripts and directories on the targeted device.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:d69bf08b6c0f7111d8a8fb90e3cbde91be17e7622e58d120a2120219a51a447a

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","product":"Router QN-I-470","vendor":"Quantum Networks","versions":[{"status":"affected","version":"at 6.1.1.B1","versionType":"custom"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:1dca5fb7e0879adf335803b2236e214ddea52c4bd8677ccc54ed7d57cf3454c7 · sha256:cf42f58aea714fa5… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"…

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:1dca5fb7e0879adf335803b2236e214ddea52c4bd8677ccc54ed7d57cf3454c7 · sha256:cf42f58aea714fa5… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-306","description":"CWE-306 Missing authentication for critical function","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:1dca5fb7e0879adf335803b2236e214ddea52c4bd8677ccc54ed7d57cf3454c7 · sha256:cf42f58aea714fa5… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion

{"tags":["third-party-advisory"],"url":"https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0200"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:1dca5fb7e0879adf335803b2236e214ddea52c4bd8677ccc54ed7d57cf3454c7 · sha256:cf42f58aea714fa5… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer