External risk intelligence

SKYWORTH SK-WR6640X Router Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-78802

The vulnerability affects a Wi-Fi 6 fiber router, which is a consumer edge networking device designed to be positioned at the internet perimeter. Such devices act as the gateway between the public internet and local networks and are commonly reachable or intended for management through network-facing interfaces.

Code Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in SKYWORTH digital Wi-Fi routers that could permit remote attackers to execute arbitrary code. This type of issue can potentially compromise the security of network access and connected devices.

Code execution vulnerability in Wi-Fi routers.
Impacts internet gateway security for businesses.
Verify exposure and potential network impact.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network requests to a SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router. This could allow them to execute arbitrary code on the device, potentially leading to a complete compromise.

Network access is required.
Specially crafted network requests trigger the vulnerability.
Arbitrary code execution leading to device compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the affected SKYWORTH DIGITAL CO.,LTD router. This could potentially lead to a complete compromise of the device and its network traffic when supported by the advisory.

Router control and network traffic.
Remote network access.
Device compromise and network eavesdropping.

Operational Fix

Recommended remediation, mitigation, and detection steps

The criticality of this remote code execution vulnerability in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) necessitates immediate attention. Given its placement at the network perimeter and potential for remote exploitation, ownership likely falls to the infrastructure or network security teams responsible for edge devices. The first practical step is to identify all instances of this router within the environment, confirm their exposure to the internet, and then assess their business criticality to prioritize remediation efforts.

Infrastructure and network security teams own.
Verify router exposure and business criticality.
Plan and execute remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the SKYWORTH SK-WR6640X router?

The SK-WR6640X is a Wi-Fi 6 dual-band fiber router (AX1800M) manufactured by SKYWORTH DIGITAL. It serves as an internet gateway, managing data traffic between a service provider's fiber network and the local devices within a home or business, such as computers, phones, and IoT hardware.

What does CVE-2026-78802 mean in plain English?

This vulnerability is classified as CWE-94, or Improper Control of Generation of Code. In simpler terms, the router fails to properly filter or sanitize incoming data, allowing an attacker to send unauthorized commands that the device mistakenly executes as legitimate instructions, potentially granting the attacker full control over the router's functions.

How is this vulnerability triggered?

An attacker triggers this by sending specially crafted network requests directly to the affected router. Note that this requires the device to be reachable over the network; the vulnerability is not triggered by standard, non-malicious browsing traffic or normal usage patterns of connected devices.

Why should I care about this router vulnerability?

According to Halo Surface Signal, this router is a consumer edge device positioned at the internet perimeter. Because it acts as the gateway between the public internet and your private network, a critical flaw here poses a significant risk as the device is inherently designed to face and handle incoming network connections.

What should I do if I use this router?

First, conduct an inventory to locate all instances of this specific model within your environment. Verify whether these devices are directly accessible from the internet. Once located, assess the business importance of the networks they protect and prioritize applying vendor-provided updates or security configurations to mitigate the risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.