CVE-2025-68719
Unauthorized Configuration Disclosure in KAYSUS KS-WR3600 Router
Publication date: 2026-01-08
Last updated on: 2026-02-02
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kaysus | ks-wr3600 | 1.0.5.9.1 |
| kaysus | ks-wr3600_firmware | 1.0.5.9.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-552 | The product makes files or directories accessible to unauthorized actors, even though they should not be. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allows an attacker who has an active session (any logged-in user) to query the backup endpoint directly and download a full configuration archive. This archive contains sensitive files such as /etc/shadow, which can be used to recover credentials and potentially fully compromise the device.
How can this vulnerability impact me? :
This vulnerability can lead to a full compromise of the affected device. An attacker can obtain sensitive configuration files and credentials, which may allow unauthorized access, control over the device, and potentially further attacks on the network or systems connected to the router.