What is the CVSS score of CVE-2025-68717?

CVE-2025-68717 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of Ks Wr3600 Firmware are affected by CVE-2025-68717?

CVE-2025-68717 presents critical security risk, a improper authentication vulnerability rated CVSS 9.4.

Is there a public PoC exploit available for CVE-2025-68717?

Yes, a public proof-of-concept exploit is available for CVE-2025-68717. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-68717?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Audit authentication configurations and rotate any potentially compromised credentials.

Ks Wr3600 Firmware CVE-2025-68717

CRITICAL

Improper Authentication (CWE-287)

2026-01-08 cve@mitre.org

Authentication Bypass Ks Wr3600 Firmware

9.4

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 02, 2026 - 16:35 vuln.today

Public exploit code

CVE Published

Jan 08, 2026 - 21:15 nvd

CRITICAL 9.4

DescriptionNVD

KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allow authentication bypass during session validation. If any user is logged in, endpoints such as /cgi-bin/system-tool accept unauthenticated requests with empty or invalid session values. This design flaw lets attackers piggyback on another user's active session to retrieve sensitive configuration data or execute privileged actions without authentication.

AnalysisAI

KAYSUS KS-WR3600 router (firmware 1.0.5.9.1) has session validation bypass – if any user is logged in, endpoints accept unauthenticated requests. Attackers piggyback on active sessions to execute privileged actions. PoC available.

Technical ContextAI

The session validation logic (CWE-287) checks only whether any active session exists, not whether the current request belongs to that session. An empty or invalid session cookie succeeds as long as someone else is logged in.

RemediationAI

Update firmware when available. Restrict management access to wired connections.

CVE-2025-68717 vulnerability details – vuln.today

Back