CVE-2026-78799

Deferred Deferred - Pending Action

Directory Traversal in iKuai 8 Router Firmware

Publication date: 2026-10-13

Last updated on: 2026-10-15

Assigner: MITRE

Description

Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition: <= iKuai 8_4.0.304-beta allows a remote attacker to execute arbitrary code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-78799

EUVD

EUVD-2026-98961

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-78799 is a Directory Traversal vulnerability in iKuai routers (IK-Q3000 model). It allows authenticated attackers to manipulate file path parameters, gaining access to directories outside intended limits. The flaw affects Enterprise Edition versions up to iKuai8_3.7.23_Enterprise Build 202606021825 and Free Edition versions up to iKuai 8_4.0.304-beta.

Detection Guidance

To detect CVE-2026-78799, check if your iKuai router runs affected versions (Enterprise <= 3.7.23 or Free <= 4.0.304-beta). Log in to the admin interface and inspect file path parameters in requests. Look for unusual directory traversal patterns like '../' in URLs or API calls. Verify firmware versions against the disclosed ranges.

Impact Analysis

An attacker could exploit this to access sensitive files, execute arbitrary code, or gain unauthorized control over the router. This may lead to network compromise, data theft, or disruption of services if the router is used in a business or organizational setting.

Compliance Impact

The vulnerability allows remote attackers to execute arbitrary code via directory traversal, which could lead to unauthorized access to sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy) by enabling data breaches or unauthorized modifications.

Mitigation Strategies

Update iKuai router firmware to versions beyond iKuai8_3.7.23_Enterprise Build 202606021825 and iKuai 8_4.0.304-beta. Disable remote administration access if not required. Restrict network access to the router's management interface. Monitor logs for suspicious path traversal attempts.

Hi! I’m here to help you understand CVE-2026-78799. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70