CVE-2025-68719: KAYSUS Router Information Disclosure Flaw

CVE-2025-68719 Overview

CVE-2025-68719 is an information disclosure vulnerability affecting KAYSUS KS-WR3600 routers running firmware version 1.0.5.9.1. The vulnerability stems from improper configuration management that allows an attacker to download a full configuration archive containing sensitive system files when any authenticated user session is active on the device. This archive includes critical files such as /etc/shadow, which contains password hashes that can be cracked offline to recover credentials and achieve full device compromise.

Critical Impact

Attackers can exploit this vulnerability to download sensitive configuration files including /etc/shadow, enabling credential recovery and potential full compromise of the affected router.

Affected Products

• KAYSUS KS-WR3600 Wireless Router
• Firmware version 1.0.5.9.1
• WiFi 7 BE3600 Router models

Discovery Timeline

• 2026-01-08 - CVE-2025-68719 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-68719

Vulnerability Analysis

This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw resides in how the KAYSUS KS-WR3600 router handles configuration backup functionality. When any legitimate user is authenticated and maintains an active session on the device, the backup endpoint becomes accessible without proper authorization checks.

The core issue is that the router fails to verify whether the requesting party is the actual authenticated user or an unauthorized third party. This broken access control allows attackers who can reach the router's management interface to directly query the backup endpoint and retrieve a complete configuration archive.

The configuration archive contains highly sensitive system files, most notably /etc/shadow, which stores hashed user credentials. Once obtained, these password hashes can be subjected to offline cracking attacks using tools like hashcat or John the Ripper, potentially revealing plaintext credentials.

Root Cause

The root cause of this vulnerability is inadequate access control enforcement on the configuration backup endpoint. The router's web management interface fails to properly validate that backup download requests originate from the authenticated session owner. Instead, the backup endpoint appears to check only whether any user session is active on the device, rather than verifying that the specific requesting client is authorized to access the backup functionality.

This design flaw represents a classic broken access control pattern where session existence is conflated with request authorization, allowing unauthorized parties to piggyback on legitimate user sessions.

Attack Vector

The attack vector is network-based and requires low privileges to execute. An attacker must have network access to the router's management interface, either from the local network or remotely if the management interface is exposed to the internet.

The exploitation scenario proceeds as follows: the attacker monitors or identifies when a legitimate administrator has logged into the router. While this session remains active, the attacker sends a direct HTTP request to the backup endpoint. Without proper session validation, the router serves the complete configuration backup archive to the attacker. The attacker then extracts sensitive files from the archive and can perform offline password cracking against the /etc/shadow file to recover administrator credentials.

Technical details and proof-of-concept information can be found in the GitHub CVE Repository.

Detection Methods for CVE-2025-68719

Indicators of Compromise

• Unexpected HTTP requests to configuration backup endpoints from IP addresses that don't match authenticated administrator sessions
• Multiple backup download requests within short timeframes, especially from different source IPs
• Access logs showing backup endpoint queries during times when no administrative activity was expected
• Evidence of offline password cracking attempts against accounts associated with the router

Detection Strategies

• Monitor web server access logs for requests to backup-related endpoints (commonly /backup, /config, /export, or similar paths)
• Implement network monitoring to detect unusual download activity from the router's management interface
• Deploy intrusion detection rules to alert on large data transfers from router management ports
• Correlate backup download events with authenticated session logs to identify mismatches

Monitoring Recommendations

• Enable verbose logging on the router management interface if supported by the firmware
• Configure network monitoring tools to baseline normal administrative traffic patterns and alert on anomalies
• Regularly audit access logs for unauthorized backup download attempts
• Consider deploying a network tap or SPAN port to capture traffic to/from the router management interface for forensic analysis

How to Mitigate CVE-2025-68719

Immediate Actions Required

• Restrict network access to the router's management interface to trusted administrator IP addresses only
• Disable remote management access if not strictly required
• Implement firewall rules to block external access to the router's web management interface
• Rotate all credentials stored on the device, including administrator passwords
• Review access logs for evidence of prior exploitation

Patch Information

At the time of publication, no official patch has been released by KAYSUS for this vulnerability. Administrators should monitor the Kaysus Product Page for firmware updates that address this security issue. Contact KAYSUS support directly for information on patch availability and timeline.

Workarounds

• Implement strict network segmentation to isolate the router management interface from untrusted network segments
• Use a VPN or jump host to access the management interface, adding an additional authentication layer
• Configure the router to accept management connections only from specific MAC addresses if supported
• Disable the configuration backup feature entirely if not required for operational purposes
• Consider deploying a dedicated management VLAN with restricted access for all network infrastructure devices

# Example firewall rules to restrict management access (iptables)
# Allow management access only from trusted admin workstation
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.100 -j ACCEPT
# Drop all other management traffic
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP