CVE-2025-68716

Executive Summary

CVE-2025-68716 is a critical security vulnerability affecting the Kaysus KS-WR3600 router running firmware version 1.0.5.9.1. The device ships with SSH enabled by default on the LAN interface, and the root account is configured with no password. Furthermore, administrators are unable to disable SSH or enforce authentication through either the CLI or web GUI. This allows any LAN-adjacent attacker to trivially gain root shell access and execute arbitrary commands with full privileges. The vulnerability is currently unpatched, and no official fix has been released by the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 9.6 (Critical)
• Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Adjacent Network (A) – The attacker must be on the same LAN as the router.
• Attack Complexity (AC): Low (L) – No special conditions or timing required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full access to all data on the router.
• Integrity (I): High (H) – Full control over router configuration and operations.
• Availability (A): High (H) – Ability to disrupt or disable router services.

Threat Level: Critical. The vulnerability is trivial to exploit and provides complete control over the router.

Deep Dive & Mechanics

The Kaysus KS-WR3600 router, with firmware version 1.0.5.9.1, has a fundamental design flaw in its authentication and service management. The SSH service is enabled by default on the LAN interface, and the root account is configured with an empty password. This is not a simple misconfiguration; the firmware intentionally prevents administrators from disabling SSH or enforcing password authentication through either the command-line interface (CLI) or the web-based GUI. This means that even if a user attempts to secure the device, they are unable to do so.

The root cause is a lack of authentication enforcement (CWE-306) for the SSH service. The device does not require any credentials to gain root-level access. This is a classic case of a backdoor-like behavior, where the manufacturer has left an unauthenticated root shell accessible to anyone on the local network.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware 1.0.5.9.1): The SSH daemon configuration likely contains a line similar to:

PermitEmptyPasswords yes

And the /etc/shadow file for the root user would have an empty password hash:

root::0:0:root:/root:/bin/sh

Additionally, the firmware's management scripts (e.g., /etc/init.d/sshd) would start the SSH service without any checks for user-configured disablement.

Patched Code (Hypothetical): A patched version would:

1. Remove the PermitEmptyPasswords yes directive from the SSH configuration.
2. Set a strong, randomized password for the root account during the initial boot.
3. Add a configuration option in the CLI and web GUI to enable/disable SSH and enforce password authentication.
4. The /etc/shadow file would contain a hashed password:

root:$6$salt$hash:0:0:root:/root:/bin/sh

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Setup:

1. Obtain a Kaysus KS-WR3600 router with firmware 1.0.5.9.1.
2. Connect the router to a switch and power it on.
3. Connect an attacker machine (e.g., Kali Linux) to the same switch.

Exploitation Steps:

1. Scan the LAN for the router's IP address (e.g., using nmap -sn 192.168.1.0/24).
2. Identify the SSH service on port 22:

   nmap -p 22 192.168.1.1
   

3. Connect to the router via SSH with the root user and no password:

   ssh root@192.168.1.1
   

4. Upon successful connection, you will have a root shell. Execute arbitrary commands:

   whoami
   id
   cat /etc/shadow
   

Post-Exploitation:

• Dump the router's configuration.
• Install a persistent backdoor.
• Use the router as a pivot point to attack other devices on the network.

Blue Team (Defense & Detection)

Detection:

• Monitor for SSH connections from unknown devices on the LAN.
• Look for successful SSH logins with the root user from unexpected IP addresses.
• Check router logs for any sshd authentication events.

Prevention:

• Isolate the router on a separate VLAN with strict access controls.
• Use network access control (NAC) to prevent unauthorized devices from connecting to the LAN.
• If possible, replace the router with a more secure model.

Mitigation (if patching is not possible):

• Place the router behind a firewall that blocks SSH traffic from untrusted LAN segments.
• Use a VPN to access the router's management interface instead of direct LAN access.

Indicators of Compromise (IOCs)

• Network:
  • SSH connections to the router's IP address on port 22 from unknown MAC addresses.
  • Unusual outbound connections from the router to external IPs (e.g., for command and control).
• Host (Router):
  • Presence of unexpected files in /tmp or /root.
  • Modified /etc/shadow file with new user accounts.
  • Running processes that are not part of the standard firmware (e.g., nc, ncat, python).
• Logs:
  • /var/log/auth.log or /var/log/messages showing successful root logins without a password.
  • SSH authentication logs showing Accepted publickey for root or Accepted password for root from unexpected sources.

Detection Engineering

YARA Rule

rule CVE_2025_68716_Kaysus_SSH_Backdoor {
    meta:
        description = "Detects Kaysus KS-WR3600 firmware with SSH backdoor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68716"
    strings:
        $ssh_config = "PermitEmptyPasswords yes" nocase
        $shadow_empty = "root::" nocase
    condition:
        $ssh_config or $shadow_empty
}

Sigma Rule

title: Kaysus KS-WR3600 SSH Backdoor Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects successful SSH logins to a Kaysus KS-WR3600 router with root user and no password
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-68716
logsource:
    product: linux
    service: sshd
detection:
    selection:
        EventID: 6001
        User: root
        AuthenticationMethod: password
        PasswordEmpty: true
    condition: selection
falsepositives:
    - Legitimate administrative access (if password is set)
level: critical

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 22 (msg:"CVE-2025-68716 Kaysus KS-WR3600 SSH Backdoor Exploit"; flow:to_server; content:"SSH-2.0-OpenSSH_"; depth:20; content:"root"; within:10; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Router: Place the Kaysus KS-WR3600 on a separate VLAN with strict firewall rules that block SSH traffic from untrusted sources.
2. Disable SSH (if possible): Check the CLI or web GUI for any option to disable SSH. If found, disable it immediately.
3. Change Root Password: If the firmware allows, set a strong password for the root account via the CLI (e.g., passwd root).

Long-Term Solutions:

1. Replace the Router: The most secure option is to replace the Kaysus KS-WR3600 with a router from a vendor that provides regular security updates and does not ship with backdoors.
2. Vendor Contact: Contact Kaysus support and demand a firmware update that fixes this vulnerability. If no update is forthcoming, consider reporting the issue to relevant cybersecurity authorities.
3. Network Segmentation: Implement strict network segmentation to limit the blast radius of any compromised device.

Workarounds:

• Use a firewall to block all inbound SSH connections to the router from the LAN.
• If SSH is required for management, use SSH key-based authentication and disable password authentication entirely (if the firmware allows).

Valters IT