CVE-2025-68717: Authentication Bypass Description KAYSUS KS-WR3600 routers with firmware version 1.0.5.9.1 allow authentication bypass during session validation. If any user is logged in, endpoints such as accept unauthenticated requests with empty or invalid session values. Attackers can piggyback on another user's active session to retrieve sensitive configuration data or execute privileged actions without authentication. Vulnerability Type Incorrect Access Control Vendor of Product KAYSUS Affected Product Code Base KAYSUS KS-WR3600 - Software Ver 1.0.5.9.1 Affected Component Web session management, authentication validation Attack Type Remote Impact Escalation of Privileges True Impact Information Disclosure True Attack Vectors The web interface fails to enforce authentication checks if any session is active. For example, the endpoint is vulnerable. References KAYSUS KS-WR3600 Product Page Vulnerability Details Discoverer Edward Warren