Approved changes feed: RSS · Atom
cpe:2.3:h:kaysus:ks-wr3600:-:*:*:*:*:*:*:*
part: h version: - update: *
| Vendor | Kaysus (35a2659d-168a-5ee5-9923-d071c60be3ac) |
|---|---|
| Product | Ks Wr3600 (af5babc6-b26f-57e3-ae67-59c66789ff7c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-68719 |
not_vulnerable | 2026-06-08 07:41:21.736516 |
Details available
KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 mishandle configuration management. Once any user is logged in and maintains an active session, an attacker can directly query the backup endpoint and download a full configuration archive. This archive contains sensitive files such as /etc/shadow, enabling credential recovery and potential full compromise of the device.
Published: 2026-01-08T00:00:00.000Z
Updated: 2026-01-08T20:59:58.111Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68717 |
not_vulnerable | 2026-06-08 07:41:21.732744 |
Details available
KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allow authentication bypass during session validation. If any user is logged in, endpoints such as /cgi-bin/system-tool accept unauthenticated requests with empty or invalid session values. This design flaw lets attackers piggyback on another user's active session to retrieve sensitive configuration data or execute privileged actions without authentication.
Published: 2026-01-08T00:00:00.000Z
Updated: 2026-01-08T20:38:47.470Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68716 |
not_vulnerable | 2026-06-08 07:41:21.732355 |
Details available
KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the LAN interface. The root account is configured with no password, and administrators cannot disable SSH or enforce authentication via the CLI or web GUI. This allows any LAN-adjacent attacker to trivially gain root shell access and execute arbitrary commands with full privileges.
Published: 2026-01-08T00:00:00.000Z
Updated: 2026-01-08T20:53:46.896Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.