External risk intelligence

KAYSUS KS-WR3600 Firmware Authentication Bypass Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2025-68717

The vulnerable product is a wireless router, which is a network edge device typically deployed as the gateway between the internet and internal networks. As an internet-facing edge service by design, its management and configuration interfaces are frequently exposed to the public internet for remote access.

Authentication Bypass

Kaysus Ks Wr3600 Firmware

1.0.5.9.1

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a security vulnerability affecting KAYSUS KS-WR3600 routers, specifically related to how user sessions are validated. The flaw allows unauthorized individuals to bypass authentication, potentially enabling them to access sensitive configuration data or perform privileged actions by exploiting active user sessions. This could lead to unauthorized control over the affected network devices.

Routers can be accessed without proper login.
Protects against unauthorized network access.
Confirm if our routers are affected and exposed.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication on KAYSUS KS-WR3600 routers by exploiting a flaw in session validation. This allows them to send unauthenticated requests to system tool endpoints, even if another user is already logged in. By doing so, they can gain access to sensitive configuration details or perform privileged actions without needing valid credentials.

No authentication needed for access.
Triggered by unauthenticated session requests.
Risk of configuration data theft.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to bypass session validation on KAYSUS KS-WR3600 routers. When a user is logged in, an attacker could send unauthenticated requests to specific endpoints, potentially leveraging an existing session to access sensitive configuration data or perform privileged actions.

Router configuration data at risk.
Bypass authentication by sending unauthenticated requests.
Unauthorized access to sensitive data.

Operational Fix

Recommended remediation, mitigation, and detection steps

For KAYSUS KS-WR3600 routers, the platform or infrastructure team is likely responsible for managing the device and its firmware. The initial practical step is to determine the reachability and business criticality of these routers, identify the accountable owner, and then plan remediation based on the assessed risk.

Platform/Infrastructure teams own the issue.
Verify router reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the KAYSUS KS-WR3600?

The KAYSUS KS-WR3600 is a Wi-Fi 7 BE3600 wireless router designed to provide network connectivity. As a networking appliance, it typically sits at the edge of a home or office environment, managing traffic between the local network and the internet. Users interface with its administrative tools to modify device configurations, manage security settings, and maintain the operational state of their connected network hardware.

How does CVE-2025-68717 allow authentication bypass?

This vulnerability is classified as CWE-287, or Improper Authentication. In the affected firmware, the router fails to correctly enforce login requirements for specific system management endpoints. Instead of verifying credentials for every request, the system incorrectly trusts incoming requests if a valid user session is already active. An attacker leverages this flaw to act as if they are the authorized user.

What triggers the vulnerability on these routers?

The vulnerability is triggered when an attacker sends requests to sensitive endpoints, such as '/cgi-bin/system-tool', without providing valid authentication. Critically, this only functions if at least one legitimate user is currently logged into the device. Requests are not triggered by the bug if no sessions are active, as the attacker relies on piggybacking off an existing, established connection.

Why is this a high-risk issue for my network?

Halo Surface Signal indicates that the KS-WR3600 is a network edge device, which is frequently exposed to the public internet to enable remote management. Because the router acts as the primary gateway for your network, an unauthenticated attacker who successfully exploits this flaw can access sensitive configuration data or perform privileged actions that would otherwise be restricted.

What should I do if I use this router?

First, identify if your organization uses the KS-WR3600 and determine where these devices are deployed. Check if the administrative management interfaces are reachable from the public internet. Coordinate with the teams responsible for infrastructure and device management to assess the criticality of the affected routers and prepare for the next steps in your patch or mitigation lifecycle.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.