CVE-2025-68707
📋 TL;DR
An authentication bypass vulnerability in Tongyu AX1800 Wi-Fi 6 Router firmware allows attackers on the same network to perform administrative actions without credentials when an admin session is active. This enables complete device takeover including configuration changes and potential network compromise. Only users of this specific router model with vulnerable firmware are affected.
💻 Affected Systems
- Tongyu AX1800 Wi-Fi 6 Router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attacker to change DNS settings, redirect traffic, install malicious firmware, and gain persistent access to the entire network.
Likely Case
Attackers on the same network (guests, neighbors) gain administrative control of the router, enabling traffic interception, network reconnaissance, and device reconfiguration.
If Mitigated
With proper network segmentation and no active admin sessions, impact is limited to potential denial of service if endpoints are accessible.
🎯 Exploit Status
Exploit requires simple HTTP requests to specific endpoints. Public GitHub repository contains technical details and proof-of-concept information.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Contact Tongyu support for firmware updates. Check vendor website regularly for security updates.
🔧 Temporary Workarounds
Disable remote admin access
allEnsure router admin interface is only accessible from wired connections or disable remote administration features
Limit admin session duration
allLog out of admin interface immediately after configuration changes and set short session timeouts
🧯 If You Can't Patch
- Replace affected router with different model or vendor
- Segment network to isolate router management interface from untrusted devices
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface. If version is 1.0.0, device is vulnerable. Test by attempting unauthenticated POST requests to /boaform/formSaveConfig endpoint.Check Version:
Login to router admin interface and navigate to System Status or Firmware Information pageVerify Fix Applied:
Verify firmware version has been updated beyond 1.0.0. Test that unauthenticated requests to vulnerable endpoints return authentication errors.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated POST requests to /boaform/formSaveConfig or /boaform/admin endpoints
- Configuration changes from non-admin IP addresses
- Multiple failed authentication attempts followed by successful admin actions
Network Indicators:
- HTTP POST requests to router IP on port 80/443 targeting formSaveConfig or admin endpoints without authentication headers
- Unusual configuration changes from unexpected source IPs
SIEM Query:
source_ip!=admin_ip AND (url_path="/boaform/formSaveConfig" OR url_path="/boaform/admin") AND http_method="POST"