CVE-2025-68716: KAYSUS KS-WR3600 Router RCE Vulnerability

CVE-2025-68716 Overview

KAYSUS KS-WR3600 routers with firmware version 1.0.5.9.1 contain a critical insecure default configuration vulnerability that enables unauthorized root access. The SSH service is enabled by default on the LAN interface with the root account configured without a password. Administrators have no ability to disable SSH or enforce authentication through either the CLI or web GUI, creating a severe security gap that allows LAN-adjacent attackers to gain complete control of the device.

Critical Impact
Any attacker with LAN access can trivially obtain root shell access and execute arbitrary commands with full privileges, enabling complete device compromise, network pivoting, and persistent backdoor installation.

Affected Products

KAYSUS KS-WR3600 Wireless Router
Firmware version 1.0.5.9.1
Devices with SSH service accessible on LAN interface

Discovery Timeline

2026-01-08 - CVE-2025-68716 published to NVD
2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-68716

Vulnerability Analysis

This vulnerability represents a fundamental insecure default configuration flaw (CWE-284: Improper Access Control) in the KAYSUS KS-WR3600 router firmware. The device ships with SSH enabled on the LAN interface and the root account configured without any password protection. This design flaw means that out-of-the-box, the router accepts passwordless SSH connections as root from any device on the local network.

The security impact is severe because the vulnerability cannot be remediated through normal administrative actions. The router's CLI and web GUI provide no mechanism to disable the SSH service or configure password authentication for the root account. This leaves network administrators with no workaround short of firmware modification or network segmentation.

Root Cause

The root cause stems from insecure firmware defaults combined with inadequate administrative controls. The firmware developers configured SSH to launch automatically on the LAN interface with root access enabled and no authentication requirement. The failure to provide administrative controls to modify this behavior compounds the issue, as security-conscious administrators cannot harden the device through normal configuration channels.

Attack Vector

An attacker positioned on the local area network can exploit this vulnerability trivially. The attack requires no authentication credentials, no exploitation of memory corruption vulnerabilities, and no specialized tools beyond a standard SSH client. The attacker simply connects to the router's LAN IP address via SSH on port 22 (default) and receives an immediate root shell.

From this position, the attacker can modify firewall rules to enable external access, install persistent backdoors, intercept network traffic, pivot to other internal systems, exfiltrate configuration data including WiFi credentials, and brick the device through firmware manipulation.

Detection Methods for CVE-2025-68716

Indicators of Compromise

Unexpected SSH connections to the router from unauthorized LAN hosts
New or modified cron jobs, startup scripts, or firmware files on the device
Changes to firewall rules or NAT configurations enabling external access
Presence of unauthorized user accounts or SSH keys on the device
Unusual outbound network connections originating from the router

Detection Strategies

Monitor network traffic for SSH connections to router management interfaces from non-administrative hosts
Implement network access control lists to restrict which devices can communicate with router management ports
Deploy network-based intrusion detection to identify suspicious SSH session patterns
Regularly audit router configurations for unauthorized modifications

Monitoring Recommendations

Enable logging on network switches to capture connection attempts to router management interfaces
Implement SIEM correlation rules to alert on SSH connections to router IPs from unexpected source addresses
Conduct periodic configuration audits comparing current device state against known-good baselines
Monitor for unusual traffic patterns indicative of data exfiltration or command-and-control activity

How to Mitigate CVE-2025-68716

Immediate Actions Required

Isolate affected KAYSUS KS-WR3600 routers to a dedicated VLAN with strict access controls
Implement network-level access control lists (ACLs) blocking SSH traffic to affected devices from untrusted hosts
Deploy a firewall rule upstream to prevent any SSH connections to the router's LAN interface
Audit affected devices for signs of compromise including unauthorized configuration changes

Patch Information

At the time of publication, no vendor-provided patch is available for this vulnerability. Administrators should monitor the KAYSUS WR3600 product page for firmware updates that address this security issue. Additional technical details can be found in the GitHub CVE-2025-68716 advisory.

Workarounds

Implement port-based network access control (802.1X) to restrict which devices can access the LAN segment containing the router
Place the router behind a managed switch with ACLs blocking port 22 traffic to the router's IP address
Consider replacing affected devices with alternatives that provide proper SSH authentication controls
If device replacement is not feasible, segment the network to minimize the number of hosts with direct LAN access to the router

bash

# Example iptables rule on upstream Linux firewall to block SSH to router
iptables -A FORWARD -d ROUTER_LAN_IP -p tcp --dport 22 -j DROP
iptables -A OUTPUT -d ROUTER_LAN_IP -p tcp --dport 22 -j DROP