SKYWORTH SK-WR6640X CVE-2026-78802

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no elevated privileges are required - remote code execution is achievable against the SK-WR6640X AX1800M firmware V1.0.3, consistent with the 'unauthorized RCE' disclosure. The practical limiting factor is network reachability to the vulnerable service: exploitation requires the attacker to reach the router's management or service interface, which on most home deployments is LAN-facing by default and only exposed to the internet if remote administration or a port-forward is enabled. The description does not name the specific vulnerable endpoint, protocol, or feature, so the precise reachable surface should be confirmed against the device configuration.

Signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) rates this 9.8 Critical, describing trivially-reachable, unauthenticated, network-based remote code execution with total impact on the device - the worst-case profile on paper. However, the exploitation-probability signals are modest: EPSS is only 0.24% (14th percentile), the CVE is NOT on CISA KEV, and there is no confirmation of active exploitation. A public technical disclosure exists (PRISMI-Team 'unauthorized-rce.md' writeup), which raises the practical likelihood of working exploit code circulating, but a PoC is a distinct signal from in-the-wild use. The key tension: a maximal CVSS paired with low EPSS and no KEV typically means the flaw is genuinely dangerous per-device but has limited mass-exploitation evidence so far - consistent with a niche consumer router rather than an internet-scale target. Net: treat as a high priority for anyone operating this specific Skyworth model (unauthenticated RCE is not deferrable), but it is not yet a confirmed widespread-exploitation emergency. Note also the CPE is a placeholder ('cpe:2.3:a:n/a:n/a'), so automated affected-product matching is unreliable - verify applicability against the exact model/firmware.

An attacker with network reachability to the router's management/service interface sends crafted input to a vulnerable endpoint that fails to sanitize attacker-controlled data (CWE-94 code injection), causing arbitrary code to execute on the device without authentication or user interaction (PR:N/UI:N). A public technical writeup describing unauthorized RCE exists, lowering the effort required to reproduce the attack; successful exploitation yields full control of the router, enabling traffic interception, pivoting into the LAN, or botnet enrollment.