Qunetswitch EUVD-2026-13722

The real-world risk profile is moderate-to-high despite missing CVSS and EPSS metrics. The vulnerability requires authenticated access (attack vector: network, privileges required: yes), which significantly reduces the threat scope compared to unauthenticated RCE. However, the technical impact is severe—successful exploitation grants arbitrary command execution, potentially leading to complete system compromise. The availability of a vendor patch (version 2.0.5.0906 and later) and official security advisory from QNAP demonstrates vendor responsiveness. Without public proof-of-concept confirmation or known active exploitation (KEV status not indicated), this vulnerability should be prioritized as a high-priority patch for all QuNetSwitch deployments, particularly in environments where user account compromise is plausible or where QuNetSwitch manages critical network infrastructure.

An attacker who has obtained valid credentials (either through social engineering, password reuse, or a prior breach) logs into the QuNetSwitch management interface over the network. Upon authentication, the attacker inputs malicious command sequences into an input field that is expected to contain benign configuration data—for example, injecting shell metacharacters and commands into a hostname or interface name field. The vulnerable application fails to sanitize this input and passes it directly to a system command, allowing the attacker's injected commands to execute with the privileges of the QuNetSwitch application, potentially enabling them to modify network configurations, exfiltrate data, or pivot to other systems on the network.