This vulnerability arises from inadequate sanitization of user‑supplied input in the management CLI interface of the Quantum Networks Router QN‑I‑470. It allows an authenticated remote attacker to inject arbitrary OS commands, resulting in remote code execution with root privileges. The attacker can compromise the device’s confidentiality, integrity, and availability, potentially taking full control of the entire router.

Quantum Networks Router QN‑I‑470 running firmware at_6.1.1.b1 is affected. The product is identified by the vendor name Quantum Networks and the model QN‑I‑470.

The CVSS score of 8.7 indicates a high severity with local privileges needed but network exposure to an authenticated attacker. The EPSS score of less than 1% suggests a very low probability of exploitation in the near term, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is a remote authenticated connection to the router’s CLI, where the attacker can supply commands that are not properly sanitized. If exploited, the attacker gains full control of the device.