The flaw lies in the firmware update process of the Qianniao QN‑L23PA0904, where the system accepts a custom iu.sh script from an SD card without proper validation. This permits arbitrary execution with system root privileges, enabling the attacker to install backdoors and exfiltrate sensitive data. The weakness is a form of improper input validation and missing authentication, as reflected by CWE‑345 and CWE‑494.

Qianniao QN‑L23PA0904 devices running firmware version v20250721.1640 are affected; no other vendors or models are listed.

The CVSS score of 6.8 indicates moderate severity. EPSS information is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited or no known commercial exploitation. The attack vector is local and requires physical insertion of an SD card containing a malicious iu.sh script; once executed, the attacker gains full root access, compromising confidentiality, integrity, and availability of the device.