CVE-2025-68718 KAYSUS CVE debrief

Who should care

Network administrators and security teams responsible for managing and securing KAYSUS KS-WR1200 routers should assess their exposure and take immediate action to mitigate the vulnerability.

Why it matters

CVE-2025-68718 is a medium-severity vulnerability in KAYSUS KS-WR1200 routers that allows LAN-adjacent attackers to gain root access due to hardcoded credentials. Network administrators and security teams should verify their exposure, restrict access, and consider upgrading or replacing affected routers.

• LAN-adjacent attackers can gain root access to the router
• Sensitive data and configurations may be exposed or compromised
• Malicious activities can be performed using the router as a pivot point
• Verification of router configurations and network traffic is necessary

Technical summary

The KAYSUS KS-WR1200 router with firmware 107 exposes SSH and TELNET services on the LAN interface with hardcoded root credentials (root:12345678). These services cannot be disabled, and the hardcoded password cannot be changed by the administrator. This allows any LAN-adjacent attacker to gain root access to the router. The vulnerability has a CVSS score of 5.4 and is classified as medium severity. The affected product is KAYSUS KS-WR1200 routers with firmware 107. The vulnerability can be mitigated by restricting access to LAN interfaces, disabling SSH and TELNET services if not required, and monitoring LAN traffic and system logs for suspicious activity.

Defensive priority

High

Recommended defensive actions

• Immediately verify and restrict access to LAN interfaces of affected KAYSUS KS-WR1200 routers
• Disable SSH and TELNET services if not required
• Change any default or hardcoded passwords if possible
• Monitor LAN traffic and system logs for suspicious activity
• Consider replacing or upgrading affected routers if possible

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, including its description, CVSS score, and affected product. The vulnerability is caused by hardcoded root credentials for SSH and TELNET services on the LAN interface of KAYSUS KS-WR1200 routers with firmware 107. The administrator cannot disable these services or change the hardcoded password. The CVE record was published on 2026-01-08T21:15:43.503Z and has not been modified since then. The NVD vulnerability detail page provides additional context,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.