EUVD-2026-108205
GHSA-5jmj-p7j2-pm54
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessJoin adjacent Wi-Fi or LAN segment
-
ExploitSend unauthenticated request to hidden_factory_switch.gch
-
ImpactHarvest leaked sensitive information
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have adjacent-network access (AV:A) - i.e., be connected to the router's own Wi-Fi or wired LAN segment; this is not internet-facing remote exploitation. Given that access, exploitation requires only an unauthenticated HTTP request (PR:N, UI:N, AC:L) to the hidden_factory_switch.gch endpoint against a default SK-WR6640X V1.0.3 configuration, with no special feature toggle described. The primary limiting factors are the adjacent-network requirement (network proximity to the device) and the fact that impact is confined to disclosure of sensitive information (C:L) with no integrity or availability effect; the specific data exposed and the underlying trigger are not described in the available sources. |
| Impact | Signals point to a low-to-moderate real-world priority, not a drop-everything emergency. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes an adjacent-network, low-complexity, unauthenticated information-disclosure flaw with only limited confidentiality impact and no integrity or availability effect. EPSS is low at 0.26% (17th percentile), there is no CISA KEV listing (not actively exploited per available data), and the vuln.today decision label is 'this_month' rather than act_now/emergency - all consistent with a non-urgent issue. The strongest caveat is a mechanism conflict: CWE-121 and the 'Buffer Overflow / Stack Overflow' tags imply memory corruption, yet both the description ('obtain sensitive information') and the CVSS impact metrics (C:L/I:N/A:N) describe pure information disclosure - these do not reconcile and should be verified with the vendor/NVD. Note also that the AV:A (adjacent) vector means this is NOT internet-wide remotely exploitable despite the description's word 'remote'; an attacker must be on the same Wi-Fi/LAN segment, which materially limits exposure. |
| Exploit ScenarioDerived | An attacker who has joined the router's local Wi-Fi or wired LAN segment (adjacent network) issues an unauthenticated HTTP request to the hidden_factory_switch.gch endpoint and receives sensitive information back from the device. Because the CVSS vector is AV:A/AC:L/PR:N/UI:N, no authentication, user interaction, or complex preconditions are required once the attacker has network proximity. A public PoC reference exists but it is not verified as working exploit code for this specific router. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
An unauthenticated information-disclosure flaw exists in SKYWORTH's SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) firmware V1.0.3, exposed through the hidden_factory_switch.gch endpoint. Attackers who are already on the router's adjacent network segment (its own Wi-Fi or wired LAN) can send a crafted HTTP request without credentials or user interaction to retrieve sensitive information; the device is not described as reachable from the internet. Impact is limited to confidentiality (CVSS 4.3, AV:A/AC:L/PR:N/UI:N/C:L/I:N/A:N), EPSS is 0.26% (17th percentile), no CISA KEV entry exists, and the available sources do not confirm working exploit code - the referenced GitHub repository is an unverified public PoC reference. Overall this is a low-to-moderate priority item rather than an emergency.
RemediationAI
No vendor-released fixed firmware version is identified in the available data, so the primary action is to check SKYWORTH's support channels (http://skyworth.com and http://sk-wr6640x.com) and the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-78801 for an updated SK-WR6640X build and apply it as soon as one is published, since the flaw is reachable pre-authentication on V1.0.3. Because exploitation requires adjacency to the router's own network segment, the most direct compensating control is to restrict who can reach the LAN/Wi-Fi: use a strong WPA2/WPA3 passphrase, avoid sharing the primary SSID with guests, and place guest or IoT clients on an isolated SSID/VLAN so they cannot reach the router's management interface - at the cost of extra configuration and possible client compatibility issues. Where the management web server can be bound to a restricted interface or disabled for untrusted segments, do so, and block HTTP access to .gch handlers at any upstream proxy or firewall if the topology allows; these measures reduce exposure but do not remove the underlying defect, and the specific data exposed is not described in the available sources, so treat any credentials or configuration reachable by the router's web service as potentially compromised and rotate them.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The target is embedded firmware on a consumer/SMB fiber router, a class of device where administrative and factory-diagnostic handlers are commonly served by a lightweight embedded HTTP daemon. The implicated endpoint, hidden_factory_switch.gch, is a factory/diagnostic style handler (the .gch extension) that is not part of the normal user-facing web UI, suggesting it remains reachable in production firmware. The description classifies the issue as CWE-121 (stack-based buffer overflow) and the tags list buffer/stack overflow, while the assessed outcome is confidentiality-only data disclosure; how memory corruption would yield only information disclosure - and the exact input that triggers it - is not described in the available sources, so the precise root cause and the specific data exposed should be treated as unverified. The CPE data provided is generic (n/a vendor/product) and the EUVD affected-version field is also n/a, so version scoping rests on the description's explicit reference to firmware V1.0.3 on the SK-WR6640X (AX1800M). The CVSS vector AV:A/AC:L/PR:N/UI:N indicates the requirement is network adjacency rather than authentication or user action.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Adjacent-network, unauthenticated access to a web endpoint yields only limited information disclosure, so AV:A/PR:N/UI:N with C:L and I:N/A:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitive information via the hidden_factory_switch.gch
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB