CVE-2026-41036 Command Injection Vulnerability in Quantum Networks Router QN-I-470
An authenticated attacker can inject OS commands via the CLI to achieve remote code execution with root privileges on Quantum Networks routers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-41036?
CVE-2026-41036 is a high-severity command injection vulnerability in Quantum Networks Router QN-I-470, published on 21 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
This vulnerability exists in Quantum Networks router due to inadequate sanitization of user-supplied input in the management CLI interface. An authenticated remote attacker could exploit this vulnerability by injecting arbitrary OS commands on the targeted device.
Successful exploitation of this vulnerability could allow the attacker to perform remote code execution with root privileges on the targeted device.
Weakness: CWE-78
Which versions are affected by CVE-2026-41036?
It affects 1 product.
Products include Qntmnet Qn-I-470 Firmware.
How do I fix CVE-2026-41036?
No fix has been published for CVE-2026-41036 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-41036 being exploited?
There is no known exploitation of CVE-2026-41036 in the wild and no public exploit code.
Other vulnerabilities in Quantum Networks Router QN-I-470
Sources
Also known as GHSA-7f6p-98mw-r63r.