A vulnerable Quantum Networks router exposes its web‑based management interface with improper access control and insecure default configuration, a weakness classified as CWE‑306 (Improper Authentication). An unauthenticated attacker can reach exposed API endpoints and read data sent by the device, including internal endpoints, scripts and directories. The flaw allows the attacker to view sensitive configuration information and potentially discover operational details of the network.

The vulnerability affects Quantum Networks Router QN‑I‑470 running firmware version 6.1.1.b1 and any earlier firmware that have not received the patch. The affected product is the Quantum Networks Router QN‑I‑470.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, but an unauthenticated attacker can still exploit the exposed APIs to gain sensitive information. In practice, the limited attack surface requires connectivity to the device’s management network and the presence of the exposed endpoints, which can be mitigated by disabling or restricting the web interface.