Description
KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the LAN interface. The root account is configured with no password, and administrators cannot disable SSH or enforce authentication via the CLI or web GUI. This allows any LAN-adjacent attacker to trivially gain root shell access and execute arbitrary commands with full privileges.
Affected products
kaysus: ks-wr3600 firmware; kaysus: ks-wr3600
References3
- github.com/actuator/cve/blob/main/KAYSUS/CVE-2025-68716.txt Third Party Advisory
- github.com/actuator/cve/tree/main/KAYSUS Third Party Advisory
- www.kaysus.com/ks_wr3600__wifi_7_be3600_wireless_router.html Product
Metrics
- CVSS 3.1
-
8.4
HIGH
Score source: CNA
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 0% percentile: 15 · as of 11 November 2026
- CWE
- CWE-284CWE-306CWE-521
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.