{"id":"CVE-2025-68707","aliases":["EUVD-2026-2217","GHSA-rjw7-q63j-3h5r"],"status":"published","title":"An authentication bypass vulnerability in the Tongyu AX1800 Wi-Fi 6 Router with firmware 1.0.0...","description":"An authentication bypass vulnerability in the Tongyu AX1800 Wi-Fi 6 Router with firmware 1.0.0 allows unauthenticated network-adjacent attackers to perform arbitrary configuration changes without providing credentials, as long as a valid admin session is active. This can result in full compromise of the device (i.e., via unauthenticated access to /boaform/formSaveConfig and /boaform/admin endpoints).","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00447,"percentile":0.39159,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-288"],"published":"2026-01-13T00:00:00Z","modified":"2026-06-17T09:59:26Z","products":[{"vendor":"tycc","product":"tongyu_ax1800_firmware"}],"references":[{"url":"https://www.tongyucom.com/product/ax1800.html","tags":["Broken Link"]},{"url":"https://github.com/actuator/cve/tree/main/Tongyu","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/actuator/cve/blob/main/Tongyu/CVE-2025-68707.txt","tags":["Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68707"},{"url":"https://github.com/advisories/GHSA-rjw7-q63j-3h5r"}],"sources":{"cve":[{"id":"CVE-2025-68707","description":"An authentication bypass vulnerability in the Tongyu AX1800 Wi-Fi 6 Router with firmware 1.0.0 allows unauthenticated network-adjacent attackers to perform arbitrary configuration changes without providing credentials, as long as a valid admin session is active. This can result in full compromise of the device (i.e., via unauthenticated access to /boaform/formSaveConfig and /boaform/admin endpoints).","status":"published","published":"2026-01-13T00:00:00Z","modified":"2026-01-16T14:36:10.227Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:32:35.742256Z"}],"euvd":[{"id":"EUVD-2026-2217","description":"An authentication bypass vulnerability in the Tongyu AX1800 Wi-Fi 6 Router with firmware 1.0.0 allows unauthenticated network-adjacent attackers to perform arbitrary configuration changes without providing credentials, as long as a valid admin session is active. This can result in full compromise of the device (i.e., via unauthenticated access to /boaform/formSaveConfig and /boaform/admin endpoints).","status":"published","published":"2026-01-13T00:00:00Z","modified":"2026-01-16T14:36:10Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:50.882066Z"}],"ghsa":[{"id":"GHSA-rjw7-q63j-3h5r","title":"An authentication bypass vulnerability in the Tongyu AX1800 Wi-Fi 6 Router with firmware 1.0.0...","description":"An authentication bypass vulnerability in the Tongyu AX1800 Wi-Fi 6 Router with firmware 1.0.0 allows unauthenticated network-adjacent attackers to perform arbitrary configuration changes without providing credentials, as long as a valid admin session is active. This can result in full compromise of the device (i.e., via unauthenticated access to /boaform/formSaveConfig and /boaform/admin endpoints).","status":"published","published":"2026-01-13T18:31:07Z","modified":"2026-01-16T15:32:28Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:05:38.741943Z"}],"nvd":[{"id":"CVE-2025-68707","description":"An authentication bypass vulnerability in the Tongyu AX1800 Wi-Fi 6 Router with firmware 1.0.0 allows unauthenticated network-adjacent attackers to perform arbitrary configuration changes without providing credentials, as long as a valid admin session is active. This can result in full compromise of the device (i.e., via unauthenticated access to /boaform/formSaveConfig and /boaform/admin endpoints).","status":"published","published":"2026-01-13T17:15:59.197Z","modified":"2026-06-17T09:59:26.56Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:11:56.616231Z"}]}}