An issue in the Skyworth Digital SK‑WR6640X Wi‑Fi 6 Dual‑Band Fiber Router allows a remote attacker to retrieve sensitive data by requesting the hidden_factory_switch.gch file. The vulnerability enables disclosure of confidential configuration or internal information to an unauthenticated actor, potentially compromising device confidentiality. The likely attack vector is network‑based, where an unauthenticated remote client accesses the vulnerable endpoint without requiring authentication. The CVE lacks an EPSS score and is not listed in CISA’s KEV catalog, indicating no known active exploitation or high‑profile incidents yet. However, the absence of a CVSS score leaves severity uncertain, though the capability to obtain sensitive data suggests a high‑risk outcome for exposed information.

The affected system is the Skyworth Digital CO., LTD SK‑WR6640X Wi‑Fi 6 Dual‑Band Fiber Router (AX1800M) V1.0.3. No other vendors, products, or versions are listed as impacted.

Without a CVSS score or EPSS data, the potential severity remains uncertain. The vulnerability requires no authentication, is reachable over the network, and would allow an attacker to gain sensitive information about the device. Because it is not yet listed in CISA’s KEV catalog, no active exploitation has been reported, but the inherent data exposure capability poses a significant risk if exploited.