The vulnerability, classified as CWE-521, allows an attacker on the same network to attempt password guessing or brute‑force attacks against user accounts in the router’s web‑based management interface because strong password policies are not enforced. Successful authentication grants the attacker full administrative access to the device, compromising confidentiality, integrity, and availability of the network infrastructure.

Quantum Networks Router model QN‑I‑470, running firmware version at_6.1.1.b1 or any earlier firmware lacking the policy enforcement fix.

The CVSS score of 7.6 indicates high severity, while the EPSS score of less than 1% shows a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no currently known widespread attacks. The likely attack vector is a local network attacker who can reach the management interface, such as an insider or compromised host.