A command injection vulnerability in QNAP Systems Inc.’s QuNetSwitch allows remote attackers to supply arbitrary command payloads via unsanitized inputs. Successful exploitation permits execution of arbitrary system commands, potentially resulting in full compromise of the switch and unauthorized access to network resources. The weakness is described by CWE-78.

The vulnerability affects devices running QuNetSwitch firmware versions prior to 2.0.4.0415. All users of earlier firmware are vulnerable; the issue is fixed in version 2.0.4.0415 and later. Check the current firmware version against this baseline.

The advisory lists a CVSS base score of 8.1, indicating high severity, and an EPSS score of 1%, suggesting a modest likelihood of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is remote network access to the switch’s management interface, where an attacker can craft input to trigger the command execution.