Qunetswitch EUVD-2026-13720

This vulnerability represents a critical real-world risk despite the absence of a CVSS score in the advisory. The attack vector is network-based with likely low complexity (using known or easily discoverable hard-coded credentials), requiring no user interaction or elevated privileges. The technical impact is severe—complete unauthorized access to network switch management functionality including configuration changes, traffic inspection, and administrative control. Although CVSS, EPSS, and KEV status data are not provided, the nature of hard-coded credentials in a network appliance strongly suggests active exploitation is probable and feasible. The availability of a patch (version 2.0.5.0906 and later) confirms vendor confirmation and validates the severity. This should be treated as a high-priority vulnerability affecting systems that cannot be immediately patched, as the attack surface is broad and exploitation barriers are minimal.

An attacker on the network identifies a QuNetSwitch appliance running a vulnerable version (pre-2.0.5.0906) and attempts to access the management interface. Rather than requiring a valid username and password, the attacker leverages publicly disclosed or reverse-engineered hard-coded credentials embedded in the application to authenticate. Upon successful authentication, the attacker gains full administrative access to the network switch, enabling them to modify network configurations, capture traffic, inject rogue routes, or use the compromised appliance as a pivot point for lateral movement within the network. The attack requires only network connectivity and knowledge of the hard-coded credentials, making it highly feasible for threat actors with basic scanning capabilities.