CVE-2025-68707: tycc tongyu ax1800 firmware

csirt@kutim:~/threat-intel/cve/CVE-2025-68707

CVSS 8.8 · High EPSS 0,45%

Kerentanan Authentication Bypass Using an Alternate Path or Channel pada tycc tongyu ax1800 firmware. Skor CVSS 3.1 8.8 (High) menurut CISA ADP.

Deskripsi (NVD)

An authentication bypass vulnerability in the Tongyu AX1800 Wi-Fi 6 Router with firmware 1.0.0 allows unauthenticated network-adjacent attackers to perform arbitrary configuration changes without providing credentials, as long as a valid admin session is active. This can result in full compromise of the device (i.e., via unauthenticated access to /boaform/formSaveConfig and /boaform/admin endpoints).

Rincian

Terbit di NVD: 13 Januari 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber CISA ADP
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-288: Authentication Bypass Using an Alternate Path or Channel
EPSS (30 hari): 0,45% peluang dieksploitasi; lebih tinggi dari 37,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
tycc	tongyu ax1800 firmware	Versi 1.0.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/actuator/cve/blob/main/Tongyu/CVE-2025-68707.txt advisory pihak ketiga
https://github.com/actuator/cve/tree/main/Tongyu exploit · advisory pihak ketiga
https://www.tongyucom.com/product/ax1800.html broken link

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.