CVE-2025-68707

Published: Jan 13, 2026Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An authentication bypass vulnerability in the Tongyu AX1800 Wi-Fi 6 Router with firmware 1.0.0 allows unauthenticated network-adjacent attackers to perform arbitrary configuration changes without providing credentials, as long as a valid admin session is active. This can result in full compromise of the device (i.e., via unauthenticated access to /boaform/formSaveConfig and /boaform/admin endpoints).

Affected (1)

Products: Tycc: Tongyu Ax1800 Firmware

1 product

Tongyu Ax1800 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tycc Tongyu Ax1800 Firmware	Version 1.0.0

Running on/with	Platform Versions
Tycc Tongyu Ax1800	All versions

Related CWEs

Authentication Bypass Using an Alternate Path or Channel

A product requires authentication, but the product has an alternate path or channel that does not require authentication.

References (3)

https://github.com/actuator/cve/blob/main/Tongyu/CVE-2025-68707.txt

Source: cve@mitre.org

Third Party Advisory

https://github.com/actuator/cve/tree/main/Tongyu

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.tongyucom.com/product/ax1800.html

Source: cve@mitre.org

Broken Link

Timeline

No history available yet.