A directory traversal vulnerability exists in the firmware of certain iKuai Wi‑Fi 6 routers, permitting a remote attacker to access files outside the intended directory. The flaw allows the attacker to manipulate the request path and ultimately load arbitrary files, which can then be executed with the privileges of the router's system process. This leads to the ability to run arbitrary code on the device, compromising confidentiality, integrity, and availability of the network infrastructure, and corresponds to an improper limitation of pathname traversal.

Affected products include routers manufactured by Quanxun Huiju Network Technology (Beijing) Co., Ltd, specifically the IK‑Q3000 Enterprise‑grade Wi‑Fi 6 wireless router in Enterprise Edition with firmware versions up to iKuai8_3.7.23_Enterprise Build 202606021825, and the Free Edition with firmware versions up to iKuai 8_4.0.304‑beta.

The vulnerability can be exploited by any host that can reach the router’s management interfaces over the network. No EPSS score or KEV listing is currently available, and the CVSS score is not disclosed, so the exact likelihood of exploitation cannot be quantified, but the presence of arbitrary code execution makes this a high‑severity risk. Attackers with network access or local network proximity could leverage this flaw to compromise the router.