What is the CVSS score of CVE-2026-30603?

CVE-2026-30603 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

N A CVE-2026-30603

EUVD-2026-18370 MEDIUM

Insufficient Verification of Data Authenticity (CWE-345)

2026-04-02 mitre

Information Disclosure N A

6.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.8 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Apr 02, 2026 - 17:00 euvd

EUVD-2026-18370

Analysis Generated

Apr 02, 2026 - 17:00 vuln.today

CVE Published

Apr 02, 2026 - 00:00 nvd

MEDIUM 6.8

DescriptionCVE.org

An issue in the firmware update mechanism of Qianniao QN-L23PA0904 v20250721.1640 allows attackers to gain root access, install backdoors, and exfiltrate data via supplying a crafted iu.sh script contained in an SD card.

AnalysisAI

Qianniao QN-L23PA0904 firmware v20250721.1640 contains an insecure firmware update mechanism that allows local attackers with SD card access to execute arbitrary code as root by supplying a crafted iu.sh script, enabling complete device compromise including backdoor installation and data exfiltration. No CVSS score is available; exploitation requires physical or logical access to the device's SD card interface. Public research documentation exists detailing the vulnerability.

Technical ContextAI

The vulnerability resides in the firmware update process of the Qianniao QN-L23PA0904 device, which executes shell scripts from removable SD card media without proper validation or signature verification. The iu.sh script, presumably part of the firmware update routine, is processed with root privileges during the update cycle. This represents a classic failure to validate external firmware inputs and enforce code signing-attackers can craft malicious iu.sh payloads that achieve arbitrary code execution when the device processes the update. The affected product appears to be a network or IoT appliance manufactured by Qianniao; exact device classification is limited by incomplete CPE data and vendor references.

RemediationAI

Firmware updates should be obtained directly from Qianniao's official website (qianniao.com) or vendor advisory channels and verified for authenticity before installation. No vendor-released patch version is specified in available data; users should contact Qianniao support or monitor their advisory page for patched firmware versions that implement cryptographic signature verification (e.g., ECDSA, RSA) for all firmware update scripts (iu.sh and related files) and restrict SD card execution to signed, validated payloads only. In the interim, organizations should implement physical access controls to limit unauthorized insertion of SD cards, restrict firmware update operations to trusted administrators, and monitor device logs for unexpected firmware update activity or shell script execution from removable media. The public research documentation at https://github.com/0xghostrush/Research/blob/main/CVE-2026-30603/CVE-2026-30603.md provides additional technical details and may include guidance on detection or mitigation.