CVE-2026-41039

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

This vulnerability exists in Quantum Networks router due to improper access control and insecure default configuration in the web-based management interface. An unauthenticated attacker could exploit this vulnerability by accessing exposed API endpoints on the targeted device.

Successful exploitation of this vulnerability could allow the attacker to access sensitive information, including internal endpoints, scripts and directories on the targeted device.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Apr 21, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-41049.8Authorization bypass through User-Controlled SQL primary key vulnerability in Akmer Informatics Automation Industry and Trade Ltd. Co. Tekno CVE-2026-410408.7GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string.CVE-2026-410419.1URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0 CVE-2026-410429.1Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server CVE-2026-410436.5Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. An aut CVE-2026-410448.8Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broke CVE-2026-410457.0A time-to-check-time-of-use in polkit authentication of qSnapper before version 1.3.3 allowed a local attacker to bypass qSnappers authentic CVE-2026-410467.3A path traversal attack when using a "configName" parameter in qSnapper before version 1.3.3 allowed a local attacker to use malicious confi CVE-2026-410475.5Lack of authentication when using the "snapshot diff" functions in qSnapper before version 1.3.3 allowed a local attacker to see otherwise r CVE-2026-410487.1Incorrect caching of authentication between different polkit methods in qSnapper before version 1.3.3 allowed a local attacker to use functi CVE-2026-410497.1Incorrect caching of authentication between different users of the qSnapper dbus service before version 1.3.3 allowed any local attacker to CVE-2026-41056.7A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation o