CVE-2025-68717

Published: Jan 8, 2026Modified: Jun 17, 2026

9.4

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Exploitability: 3.9 / Impact: 5.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allow authentication bypass during session validation. If any user is logged in, endpoints such as /cgi-bin/system-tool accept unauthenticated requests with empty or invalid session values. This design flaw lets attackers piggyback on another user's active session to retrieve sensitive configuration data or execute privileged actions without authentication.

Affected (1)

Products: Kaysus: Ks Wr3600 Firmware

1 product

Ks Wr3600 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Kaysus Ks Wr3600 Firmware	Version 1.0.5.9.1

Running on/with	Platform Versions
Kaysus Ks Wr3600	All versions

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (3)

https://github.com/actuator/cve/blob/main/KAYSUS/CVE-2025-68717.txt

Source: cve@mitre.org

Third Party Advisory

https://github.com/actuator/cve/tree/main/KAYSUS

Source: cve@mitre.org

Exploit

https://www.kaysus.com/ks_wr3600__wifi_7_be3600_wireless_router.html

Source: cve@mitre.org

Product

Timeline

No history available yet.