Critical severity9.4NVD Advisory· Published Jan 8, 2026· Updated Jun 17, 2026
CVE-2025-68717
CVE-2025-68717
Description
KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allow authentication bypass during session validation. If any user is logged in, endpoints such as /cgi-bin/system-tool accept unauthenticated requests with empty or invalid session values. This design flaw lets attackers piggyback on another user's active session to retrieve sensitive configuration data or execute privileged actions without authentication.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:o:kaysus:ks-wr3600_firmware:1.0.5.9.1:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
3- github.com/actuator/cve/tree/main/KAYSUSnvdExploit
- github.com/actuator/cve/blob/main/KAYSUS/CVE-2025-68717.txtnvdThird Party Advisory
- www.kaysus.com/ks_wr3600__wifi_7_be3600_wireless_router.htmlnvdProduct
News mentions
0No linked articles in our index yet.