The flaw stems from the absence of rate limiting and CAPTCHAs on the web‑based administration portal of Quantum Networks routers. This allows an attacker who can reach the interface to attempt uncontrolled login guesses, potentially gaining root privileges on the device. The weakness aligns with CWE‑307, where insecure default or weak authentication permits credential stuffing or brute‑force attacks.

Quantum Networks routers, model QN‑I‑470. All firmware releases prior to version 7.5.4.B9—specifically those identified as at_6.1.1.b1 and earlier—are susceptible, as the vendor’s advisory recommends upgrading to firmware 7.5.4.B9 to remediate the issue.

The CVSS score of 8.7 marks the vulnerability as high severity. While the EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, an attacker on the same local network can still exploit the web interface to conduct brute‑force attempts. Successful exploitation would grant full administrative control, leading to complete compromise of the device and potential lateral movement within the network.