CVE-2025-68716

Katalog CVE

CVSS 8.4 · High EPSS 0,24%

Kerentanan Improper Access Control pada kaysus ks-wr3600 firmware. Skor CVSS 3.1 8.4 (High) menurut CISA ADP.

Deskripsi (NVD)

KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the LAN interface. The root account is configured with no password, and administrators cannot disable SSH or enforce authentication via the CLI or web GUI. This allows any LAN-adjacent attacker to trivially gain root shell access and execute arbitrary commands with full privileges.

Rincian

Terbit di NVD

8 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.4 (High), sumber CISA ADP
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-306: Missing Authentication for Critical Function
CWE-521: Weak Password Requirements

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 13,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/actuator/cve/blob/main/KAYSUS/CVE-2025-68716.txt advisory pihak ketiga
• https://github.com/actuator/cve/tree/main/KAYSUS advisory pihak ketiga
• https://www.kaysus.com/ks_wr3600__wifi_7_be3600_wireless_router.html product