An issue in SKYWORTH DIGITAL CO., LTD SK‑WR6640X Wi‑Fi 6 Dual‑Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to retrieve the hidden_factory_switch.gch file, potentially exposing confidential configuration or internal data. The vulnerability arises from an unintended disclosure of a hidden file via the router’s interface. The description does not explicitly state the required authentication, but based on the wording it is inferred that the file can be accessed without authentication and that the attacker can read the file through the router’s network interface, compromising device confidentiality.

The affected system is the SKYWORTH DIGITAL CO., LTD SK‑WR6640X Wi‑Fi 6 Dual‑Band Fiber Router (AX1800M) running firmware V1.0.3; no other vendors or products are listed as impacted.

Based on the CVSS score of 4.3, the severity is moderate. The EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not catalogued in CISA’s KEV. It is inferred that the attacker can exploit the issue over the network via an unauthenticated request to the router’s hidden_factory_switch.gch endpoint. This would expose sensitive data that could serve as a foothold for further attacks, but no active exploits have been observed yet.