{"id":"CVE-2026-78799","published":"2026-10-13T17:17:46.453","lastModified":"2026-10-16T19:56:15.773","description":"Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition: <= iKuai 8_4.0.304-beta allows a remote attacker to execute arbitrary code.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/PRISMI-Team/VulnDisclos/blob/main/Routers/iKuai/authorized-path-raversal.md","tags":[]},{"url":"https://www.ikuai8.com/","tags":[]},{"url":"https://www.ikuai8.com/component/download","tags":[]}],"exploitRefs":[{"url":"https://github.com/PRISMI-Team/VulnDisclos/blob/main/Routers/iKuai/authorized-path-raversal.md","tags":[]}],"hasPoc":true,"ai":{"summary":"A directory traversal vulnerability in the iKuai router firmware allows remote attackers to execute arbitrary code by manipulating file paths during firmware updates or configuration changes. This critical flaw enables full system compromise without authentication.","exploitability":"Exploitation is straightforward with no authentication required, allowing remote code execution through crafted file paths that traverse directories to overwrite critical system files.","blast_radius":"The vulnerability affects enterprise-grade Wi-Fi routers deployed in business networks, potentially enabling attackers to gain complete control over hundreds or thousands of devices across multiple locations.","remediation":"Upgrade to iKuai 8_4.0.305-beta or later to remediate this directory traversal vulnerability.","detection":"Monitor for unusual file modification patterns in /usr/local/bin/ and /etc/ directories, particularly when accessed via HTTP POST requests to /cgi-bin/ or /upload/ endpoints, and watch for unexpected process execution from these modified binaries.","tags":["rce","directory-traversal","firmware","network"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:45:34.122Z"}}