This vulnerability (CVE-2026-41039) affects Quantum Networks Router QN-I-470 version 6.1.1.B1. It arises from CWE-306: Missing Authentication for Critical Function, specifically due to improper access control and insecure default settings in the router's web management interface. An unauthenticated attacker can access exposed API endpoints, potentially retrieving sensitive internal information including endpoints, scripts, and directories. The CVSS 4.0 base score is 8.7 (high severity), reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality. No patch or official remediation level has been published, and no known exploits are reported in the wild.

Successful exploitation can lead to unauthorized access to sensitive internal information on the affected router, including internal API endpoints, scripts, and directories. This exposure could facilitate further attacks or information disclosure. The vulnerability does not require authentication, privileges, or user interaction, increasing its risk. However, there is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict network access to the router's management interface, disable or secure exposed API endpoints if possible, and review device configurations to minimize exposure. Monitor vendor communications for updates on patches or official mitigations.