The vulnerability allows a remote attacker to run arbitrary code on the router, which can lead to full compromise of the device. This flaw is a classic code injection flaw that would let an attacker gain privileged control over the appliance, potentially exposing the network it serves and allowing further lateral movement. The impact is significant, affecting confidentiality, integrity, and availability of the network infrastructure.

Skyworth Digital SK-WR6640X Wi‑Fi 6 Dual‑Band Fiber Router (AX1800M) V1.0.3 is the only product identified as affected. No additional versions or models were reported in the data.

Exploitability is likely straightforward over the internet because the attack can reach the device remotely and no authentication is required, a detail inferred from the context rather than explicitly stated in the CVE data. The CVSS score is 9.8 and the EPSS score is < 1%, and the vulnerability is not listed in CISA KEV. Despite the low EPSS, remote code execution flaws are inherently high risk and should be treated with urgency. The likely attack vector is network‑based, targeting the router’s management interface or firmware update mechanism, with no authentication required—this inference is drawn from the description but is not explicitly detailed.