iKuai IK-Q3000: Directory traversal allowing remote code execution
Summary
Certain iKuai8 firmware builds for the IK-Q3000 enterprise Wi-Fi 6 router and the Free Edition contain a directory traversal flaw (CWE-22) in path handling. The CVE record says a remote attacker can execute arbitrary code, and NVD scores it 9.8 (critical), which implies no authentication and network access. The public disclosure describes an authenticated attacker who manipulates path parameters to reach locations outside the intended directory, so the actual preconditions are not fully clear. Exposed management interfaces are the main risk.
Affected
- IK-Q3000 Enterprise Edition: iKuai8_3.7.23_Enterprise Build 202606021825 and earlier
- Free Edition: iKuai 8_4.0.304-beta and earlier
- Affected versions per the NVD description and the disclosure; vendor confirmation pending.
Fixed in
Unknown. No vendor advisory or fixed build has been confirmed. Newer builds listed by a third-party mirror are not confirmed as fixes.
Workaround
- No vendor workaround found.
- Remove WAN or internet exposure of the web and management interface.
- Restrict administrative access to a trusted LAN or VPN.
Exploitation
- No evidence of in-the-wild exploitation was found. Secondary sources list it as not in the CISA KEV catalog; verify against the CISA catalog.
- A public disclosure repository exists; its exploit details were not verified.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
Our recommendation
- Check whether any iKuai IK-Q3000 device in your environment runs an affected build.
- Immediately remove internet exposure of management interfaces on affected devices.
- Restrict admin access to trusted networks and review logs for unusual requests.
- Contact iKuai or your reseller for a fixed build and apply it once confirmed.
- If no fix is available, plan replacement with a vendor that publishes patches and advisories.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Disclosure repository (PRISMI-Team VulnDisclos) github.com
- iKuai vendor website www.ikuai8.com
- iKuai download page www.ikuai8.com
- VulnRichment record (Vulners) vulners.com
- VulDB entry 417806 vuldb.com
- Strix CVE record www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:02.
Original description (NVD)
Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition: <= iKuai 8_4.0.304-beta allows a remote attacker to execute arbitrary code.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.