CVE-2025-68717: Ks-wr3600 Firmware: hatalı kimlik doğrulama

Açıklama (NVD)

KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allow authentication bypass during session validation. If any user is logged in, endpoints such as /cgi-bin/system-tool accept unauthenticated requests with empty or invalid session values. This design flaw lets attackers piggyback on another user's active session to retrieve sensitive configuration data or execute privileged actions without authentication.

Özet bilgiler

Ürün

Kaysus Ks-wr3600 Firmware

CVSS v3.1

9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

EPSS

%0,56 (yüzdelik 47)

CWE

CWE-287

Yama

Yok / bilinmiyor

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• github.com
• github.com
• www.kaysus.com
• CWE-287