A vulnerability involving hard‑coded credentials was identified in QNAP Systems Inc.'s QuNetSwitch device. This flaw permits a remote attacker to authenticate without valid user input, granting unauthorized access to the system. The weakness is classified under CWE-798.

All releases of QuNetSwitch prior to version 2.0.5.0906 are affected. Products from QNAP Systems Inc. that include QuNetSwitch firmware below this version contain the hard‑coded credential flaw.

The vulnerability carries a CVSS score of 6.8, indicating moderate severity. The EPSS score is below 1 %, implying a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers could exploit the flaw by interacting with the device over the network, targeting the management interface or other exposed services that rely on the hard‑coded credentials. No additional prerequisites beyond network access are described in the advisory.