Executive Summary

The vulnerability exists in KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1, where the SSH service is enabled by default on the LAN interface. The root account has no password set, and administrators cannot disable SSH or enforce authentication through the CLI or web GUI. This allows any attacker with LAN access to easily gain root shell access and execute arbitrary commands with full privileges.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker on the local network to gain root-level access to the router without any authentication. With full root privileges, the attacker can execute arbitrary commands, potentially compromising the entire network, intercepting or modifying traffic, disrupting services, or using the router as a foothold for further attacks.

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking if the KAYSUS KS-WR3600 router is running firmware version 1.0.5.9.1 and if the SSH service is enabled on the LAN interface. Since the root account has no password and SSH cannot be disabled or secured, you can attempt to connect via SSH from the LAN side using a command like 'ssh root@<router_ip>' without a password prompt. Successful login without authentication indicates the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include isolating the affected router from untrusted LAN networks to prevent unauthorized SSH access, and if possible, replacing the device or firmware with a secure version. Since the SSH service cannot be disabled or secured via CLI or web GUI, network-level controls such as firewall rules blocking SSH access to the router from LAN devices should be implemented.

Useful 0 Not Useful 0