CVE-2025-68716 KAYSUS CVE debrief

Who should care

LAN administrators and security teams responsible for KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 should verify and mitigate SSH exposure to prevent adjacent attackers from gaining root shell access.

Why it matters

CVE-2025-68716 is a high-severity vulnerability in KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1, allowing adjacent attackers to gain root shell access and execute arbitrary commands due to SSH being enabled by default with a root account and no password.

• LAN administrators must verify SSH exposure and disable or secure it to prevent unauthorized access.
• Adjacent attackers can gain root shell access and execute arbitrary commands with full privileges.
• The vulnerability allows for trivial exploitation, making it a high priority for mitigation.

Technical summary

KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service by default on the LAN interface. The root account is configured with no password, allowing any LAN-adjacent attacker to trivially gain root shell access and execute arbitrary commands with full privileges. This vulnerability is a high-severity issue due to its ease of exploitation and potential impact. LAN administrators and security teams should prioritize verification and mitigation of SSH exposure to prevent unauthorized access and potential command execution.

Defensive priority

High priority for LAN administrators to verify and mitigate SSH exposure.

Recommended defensive actions

• Verify LAN exposure of KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1
• Disable SSH or enforce authentication on the LAN interface
• Monitor for adjacent attackers attempting to gain root shell access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail page confirm that KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 have SSH enabled by default on the LAN interface with a root account and no password. This information is corroborated by multiple sources, including official CVE metadata and NIST NVD assessments. However, the exact scope of affected deployments and potential variations in exposure are not detailed in the available sources. Defenders should verify LAN exposure of these routers and review SSH configurations to ensure proper security.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.