External risk intelligence

IK-Q3000 Wi-Fi Router Directory Traversal Allows Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-78799

The vulnerability affects enterprise-grade and standard wireless routers. These devices are designed to act as internet edge gateways and typically feature web-based management interfaces that are commonly exposed to the network or directly to the internet to facilitate remote administration and connectivity.

Path Traversal

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical directory traversal vulnerability found in specific versions of Quanxun Huiju Network Technology's IK-Q3000 routers. The flaw could allow an unauthenticated remote attacker to execute arbitrary code, potentially impacting network security and operations. The main concern is confirming relevance and exposure to this vulnerability.

Attackers can bypass security controls.
Affects network edge devices with remote access.
Confirm exposure and assess device criticality.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this directory traversal vulnerability by sending specially crafted requests over the network to the vulnerable IK-Q3000 wireless router. This could allow them to read and write files on the system, potentially leading to arbitrary code execution.

Requires network access.
Triggered by a crafted network request.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A directory traversal vulnerability in certain Quanxun Huiju Network Technology (Beijing) Co., Ltd. IK-Q3000 Enterprise-grade Wi-Fi 6 wireless routers could allow a remote attacker to execute arbitrary code. This could occur when the router's management interface is accessible over the network.

Router system files.
Remote code execution possible.
Compromise of network device.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vulnerability affects enterprise-grade and standard wireless routers, which often serve as internet edge gateways. Responsibility for remediation likely falls to infrastructure or platform teams managing these network devices, in coordination with security teams to assess exposure. The immediate first step is to identify all instances of the affected technology, determine their reachability and business criticality, and then assign ownership for planning and executing the appropriate response.

Assign ownership to network infrastructure teams.
Verify external reachability and business impact.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the IK-Q3000 router mentioned in CVE-2026-78799?

The IK-Q3000 is a Wi-Fi 6 wireless router manufactured by Quanxun Huiju Network Technology. These devices function as enterprise-grade network infrastructure, typically acting as internet edge gateways that manage traffic flow and provide connectivity for organizational networks.

What is a directory traversal vulnerability?

This weakness, categorized as CWE-22, occurs when a system fails to properly sanitize user input, allowing attackers to access files or directories outside the intended folder. In CVE-2026-78799, this flaw allows attackers to reach restricted system files, which can then be manipulated to achieve arbitrary code execution.

How does an attacker trigger CVE-2026-78799?

An attacker triggers this bug by sending specially crafted network requests to the router. It is important to note that this requires network connectivity to the device's management interface; simple legitimate traffic or standard web browsing will not initiate this vulnerability.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates that because these routers serve as internet edge gateways, their management interfaces are often exposed to the network or directly to the internet for remote administration. Devices with this management interface reachable from outside your protected network face a higher risk of being targeted.

What are the first steps to handle this vulnerability?

Begin by creating an inventory of all IK-Q3000 routers within your environment. Once identified, determine which devices have management interfaces reachable via the network and assess their business criticality. Coordinate with your network infrastructure teams to restrict access while you plan the necessary updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.