iKuai8 Firmware CVE-2026-78799

Exploitation targets the management interface of the iKuai IK-Q3000 / iKuai8 firmware (Enterprise Edition <= iKuai8_3.7.23 Build 202606021825; Free Edition <= iKuai 8_4.0.304-beta) via a directory-traversal flaw (CWE-22) that escapes the intended file path to achieve code execution. The input CVSS marks PR:N (no privileges), but the public disclosure is titled 'authorized' path traversal, so a valid authenticated management session is most likely a prerequisite and is the key limiting factor - verify with the vendor. Further limits on real-world exploitation: the attacker must have network reachability to the router's administrative/web service (devices with management exposed only on an internal/LAN interface are far less exposed), and only the listed firmware builds and earlier are affected.

The input CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, low-complexity, unauthenticated path-traversal leading to arbitrary code execution - the classic 'critical, drop-everything' profile. However, the signals conflict and should temper that urgency. First, there is a CONFLICT between the CVSS PR:N (unauthenticated) and the public disclosure, whose filename is 'authorized-path-raversal.md' - strongly implying that authentication/authorization is in fact required; if true, the honest vector is PR:L, which materially lowers real-world risk and should be verified with the vendor. Second, EPSS is only 0.45% (38th percentile), indicating low modeled exploitation probability despite the high CVSS. Third, the CVE is NOT listed in CISA KEV, so there is no evidence of active exploitation. A third-party technical disclosure exists on GitHub (PRISMI-Team/VulnDisclos), so publicly available exploit/technical detail should be assumed. No SSVC decision data was provided. Net: this is a genuinely high-impact bug on a network device, but the combination of low EPSS, no KEV, a niche vendor, and the 'authorized' naming suggests it is a priority for operators of this specific router rather than a broad, wormable internet emergency. Treat the 9.8 as an upper bound pending confirmation of the authentication requirement.

A remote attacker who can reach the router's management/web interface sends a crafted request containing directory-traversal sequences (e.g., ../) to a vulnerable endpoint, escaping the intended path and writing to or reading from an arbitrary location, which is leveraged to achieve arbitrary code execution on the device. Public technical details exist in the PRISMI-Team disclosure, and the CVSS AC:L rating indicates the attack is reliable and requires no special timing or configuration; note the disclosure's 'authorized' naming implies the attacker likely needs valid credentials or a logged-in session first.