CVE-2026-78802

Executive Summary

CVE-2026-78802 is a critical remote code execution vulnerability affecting the SKYWORTH SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) running firmware version V1.0.3. A remote, unauthenticated attacker can exploit this flaw to execute arbitrary code on the affected device, granting full control over the router's operating environment. As of this report, no official patch, workaround, or public proof-of-concept exists, and the vulnerability has not been scored by NVD or FIRST.org EPSS — leaving affected deployments fully exposed with no vendor-supplied remediation path.

Technical Analysis

CVE-2026-78802 is classified at the vulnerability-class level as an arbitrary code execution flaw reachable via remote, network-accessible attack surface on the SKYWORTH SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) firmware version V1.0.3. The NVD description explicitly states that the issue "allows a remote attacker to execute arbitrary code," confirming that the vulnerability is network-reachable and does not require authentication as a precondition for exploitation as described.

The affected device is a consumer/SOHO-grade fiber router combining Wi-Fi 6 dual-band access point functionality with fiber WAN termination — meaning it sits at the network perimeter of home and small-business environments. Its management plane (typically exposed on LAN and, in misconfigured or feature-enabled deployments, on WAN) and its web-based administrative interface constitute the primary attack surface for a remote code execution flaw of this class.

The NVD entry provides no CWE classification, no CVSS vector from NVD, no CNA title, and no description of the specific vulnerable component (e.g., no mention of a particular CGI handler, configuration parameter, diagnostic endpoint, or parsing routine). Consequently, the precise code-level mechanism — whether the flaw arises from insufficient input validation on a request parameter, unsafe command construction, a buffer handling error, or a deserialization path — cannot be determined from the available data. Any claim specifying the exact injection point, parameter name, or function would be fabricated and is deliberately omitted here.

What is derivable with confidence from the description:

• The flaw is remotely triggerable (network attack vector, no physical or local access implied).
• The outcome is arbitrary code execution, i.e., attacker-controlled code running with the privileges of the vulnerable router process (commonly root on embedded Linux-based router firmware).
• The affected build is firmware V1.0.3, the sole version identified.

The absence of a CWE assignment and CVSS vector from the upstream feeds reflects how recently or sparsely this CVE has been processed, not an absence of severity. By the vulnerability class (remote unauthenticated RCE), the realistic impact profile is confidentiality, integrity, and availability all High, with no privileges or user interaction required — reflected in the vector supplied in the metadata section above as an analytic estimate for this class, not an NVD-published value.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-78802. The attack chain below is described strictly at the vulnerability-class level, in accordance with the limited technical detail in the NVD description. No specific endpoints, parameters, or function names are asserted because none are provided in the source data.

1. Reconnaissance / target identification. An attacker enumerates internet-exposed SKYWORTH SK-WR6640X (AX1800M) devices. Identification is typically performed via fingerprinting of the HTTP management interface, router banner/HTML content, or TLS certificate attributes on the device's administrative service. Exposed management interfaces on the WAN side — whether by default, through a remote-management feature, or via misconfiguration — represent the highest-value targets, as the flaw is described as remotely exploitable.

2. Triggering the flaw class. The attacker sends a crafted network request to the device's exposed management/administrative service. Because the flaw class is remote arbitrary code execution, the malformed input is designed to reach a code path where attacker-supplied data influences execution. The specific input location is not documented in available intelligence; at the class level, the trigger is an unsanitized or insufficiently validated request that the vulnerable firmware processes without adequate boundary enforcement.

3. Payload / execution method. Successful triggering results in execution of attacker-controlled code on the router. Class-level payload options include commands executed by the embedded firmware's shell, or code injected into a legitimate router process. The attacker gains code execution at whatever privilege the vulnerable service runs under — on embedded router firmware this is frequently an elevated or root-equivalent context.

4. Post-exploitation impact. With arbitrary code execution, the attacker can achieve full device compromise: reading and modifying router configuration, exfiltrating credentials (including Wi-Fi PSKs, PPPoE/ISP credentials, and admin passwords), establishing persistence, redirecting or intercepting network traffic (DNS manipulation, traffic proxying), enrolling the device into a botnet, or using it as a pivot into the downstream LAN. Because the device is typically the network edge, compromise grants a privileged position for man-in-the-middle activity against all connected clients.

Impact Assessment

• Confidentiality (High): Full read access to device configuration, credentials, and potentially all traffic transiting the router.
• Integrity (High): Ability to modify firmware behavior, routing, DNS, and firewall rules; persistent backdoor installation is feasible under arbitrary code execution.
• Availability (High): The device can be rendered unusable (bricked, disable network services) or repurposed, disrupting connectivity for every downstream client.
• Attack Vector (Network), Attack Complexity (Low), Privileges Required (None), User Interaction (None): As described, no authentication or user action is a stated precondition, maximizing reachability.

Blast radius: Every SKYWORTH SK-WR6640X (AX1800M) deployed at firmware V1.0.3 that exposes its management surface is potentially affected. Because these are edge devices, each compromise extends to the entire downstream network segment. Small-office and residential deployments — where firmware patching cadence is lowest and management interfaces are most likely left exposed — face the greatest risk. There is no vendor fix and no CISA KEV listing at time of writing, meaning organizations cannot rely on vendor-driven remediation signals and must detect and isolate manually.

Detection Guidance

Sigma Rule

title: Suspicious HTTP Request to SKYWORTH SK-WR6640X Management Interface
id: 3f1b9a72-8c4e-4d21-b7a0-9e2c5f6d1a34
status: experimental
description: Detects anomalous requests to SKYWORTH SK-WR6640X (AX1800M) router management interface consistent with remote code execution probing against CVE-2026-78802.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78802
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_ua:
    cs-useragent|contains:
      - 'SKYWORTH'
      - 'AX1800M'
      - 'SK-WR6640X'
  selection_suspicious:
    cs-uri-query|contains:
      - ';'
      - '|'
      - '`'
      - '$('
      - '&&'
      - '/bin/'
      - 'wget '
      - 'curl '
  condition: selection_suspicious
  timeframe: 5m
falsepositives:
  - Legitimate administrative configuration containing shell metacharacters
level: high
tags:
  - attack.t1190
  - cve.2026.78802

YARA Rule

rule CVE_2026_78802_SKYWORTH_RCE
{
    meta:
        description = "Detects SKYWORTH SK-WR6640X (AX1800M) firmware V1.0.3 artifacts and common RCE dropper markers"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-78802"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $fw1 = "SK-WR6640X" ascii wide
        $fw2 = "AX1800M" ascii wide
        $fw3 = "SKYWORTH" ascii wide
        $v1  = "V1.0.3" ascii wide
        $cmd1 = "/bin/sh" ascii
        $cmd2 = "wget " ascii
        $cmd3 = "curl " ascii
        $cmd4 = "chmod +x" ascii
        $drop1 = "/tmp/" ascii
        $drop2 = "/var/tmp/" ascii

    condition:
        (
            (2 of ($fw*) and $v1)
        ) or
        (
            uint32(0) == 0x464C457F and 2 of ($cmd*)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-78802 SKYWORTH SK-WR6640X Potential RCE Attempt"; flow:to_server,established; http.header; content:"SKYWORTH"; http.header; content:"SK-WR6640X"; pcre:"/(%3B|;|%7C|\||%60|`|\$\(|\%24\%28)/Ui"; classtype:attempted-admin; reference:cve,2026-78802; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-78802; sid:202678802; rev:1; metadata:affected_product SKYWORTH_SK-WR6640X, attack_target Networking_Equipment, created_at 2026_01_01, cve CVE_2026_78802, signature_severity Critical;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and
      http.request.method in ("GET", "POST") and
      (http.request.body.content : "*SK-WR6640X*" or
       http.request.body.content : "*AX1800M*") and
      (http.request.body.content : "*;*" or
       http.request.body.content : "*|*" or
       http.request.body.content : "*$(*" or
       http.request.body.content : "*`*") ]
  [ process where event.type == "start" and
      process.name in ("sh", "busybox", "wget", "curl", "telnetd") ]

Splunk SPL Query

index=web OR index=network sourcetype=access_combined OR sourcetype=stream:http
| eval suspect=if(
    match(uri_query, "[;|`]|\$\(|%3B|%7C|%60") AND
    (match(http_user_agent, "SKYWORTH|SK-WR6640X|AX1800M") OR match(uri_path, "SKYWORTH|SK-WR6640X")),
    "possible_cve_2026_78802_exploit", "benign")
| where suspect="possible_cve_2026_78802_exploit"
| stats count values(uri_path) as paths values(uri_query) as queries by src_ip, dest_ip, http_user_agent
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="web,router,cve_2026_78802,">
  <rule id="202678802" level="12">
    <if_sid>31100</if_sid>
    <field name="url">SK-WR6640X|AX1800M|SKYWORTH</field>
    <regex type="pcre2">[;|`]|\$\(|%3B|%7C|%60</regex>
    <description>CVE-2026-78802: Possible SKYWORTH SK-WR6640X remote code execution attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_78802,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED) — no patch evidence from any tracked source. No vendor fix, no workaround, and no affected-version enumeration beyond firmware V1.0.3 are available.

1. Immediate mitigations:

   • Disable WAN-side administrative/remote-management access to the router's web interface if not strictly required.
   • Restrict management interface reachability to a trusted LAN segment or management VLAN; block inbound access to the device management port at the upstream firewall.
   • Where the device cannot be isolated, place it behind a filtering gateway and monitor for the suspicious request patterns defined in the Detection Guidance section.
   • Change default administrative credentials if any remain in place, acknowledging that this does not remediate the underlying RCE.

2. Patch / upgrade steps:

   • No patched firmware version has been published or verified. Monitor SKYWORTH's official support/download channel for a firmware release addressing CVE-2026-78802.
   • Do not deploy unverified third-party firmware; validate any vendor-released image against official checksums.
   • If a patched build later becomes available, upgrade to the newest vendor firmware and verify the version string post-upgrade.

3. Long-term hardening:

   • Replace the SKYWORTH SK-WR6640X (AX1800M) with a device that has an active security-response program and a documented patch cadence, given the absence of any vendor fix for this CVE.
   • Enforce a firmware-update policy for all network edge devices with quarterly review cycles.
   • Segment IoT/SOHO routers from sensitive networks; apply egress/ingress filtering and DNS monitoring at the perimeter.
   • Maintain an asset inventory of edge devices so that affected units can be rapidly located and isolated when advisories are published.

References

• NVD — CVE-2026-78802: https://nvd.nist.gov/vuln/detail/CVE-2026-78802
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CWE — CWE-94 Improper Control of Generation of Code ('Code Injection'): https://cwe.mitre.org/data/definitions/94.html
• CISA Known Exploited Vulnerabilities Catalog (verify current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored at time of writing): https://www.first.org/epss/

Threat actor campaign attribution and exploit-in-the-wild evidence: none available. No public PoC, Nuclei template, or exploit code has been identified for CVE-2026-78802, and the CVE is not listed in CISA KEV.