Qunetswitch EUVD-2026-13716

Remote unauthenticated attacker can exploit this command injection vulnerability in QuNetSwitch versions prior to 2.0.4.0415. No special configuration, user interaction, or authentication required. CVSS:4.0 indicates network-accessible command execution vulnerability.

This vulnerability presents a critical risk despite the absence of explicit CVSS scores and EPSS data in the provided intelligence. The attack vector is remote, the vulnerability requires no authentication based on the description, and the technical impact is complete system compromise (arbitrary command execution). While CVSS and EPSS scores are not available from the sources provided, the nature of unauthenticated remote command injection in network infrastructure management software places this in the highest risk category. The existence of a vendor patch (version 2.0.4.0415 and later) indicates the vulnerability was confirmed and actively exploited in production environments. The lack of KEV or public POC data in the provided intelligence does not diminish the severity—command injection vulnerabilities in management interfaces are typically exploited in targeted attacks against infrastructure. Organizations managing QNAP QuNetSwitch devices should treat this as an immediate patching priority.

An attacker on the same network or with network access to a QNAP QuNetSwitch management interface identifies an unauthenticated or insufficiently authenticated API endpoint. The attacker crafts a malicious request containing shell metacharacters (such as semicolons, pipes, or command substitution syntax) in a parameter that the application passes to a system command. The injection succeeds because input validation is missing, allowing the attacker to execute arbitrary commands with the privileges of the QuNetSwitch application, potentially gaining full control of the switch and access to network management functions.