CVE-2025-68707 is a critical authentication bypass vulnerability identified in the Tongyu AX1800 Wi-Fi 6 Router running firmware version 1.0.0. The flaw allows an unauthenticated attacker who is network-adjacent—that is, on the same local network or able to reach the device's management interface—to bypass authentication controls and perform arbitrary configuration changes. This is possible because the router's web management interface exposes endpoints (/boaform/formSaveConfig and /boaform/admin) that accept configuration commands without verifying credentials if a valid admin session is active elsewhere. Essentially, the vulnerability leverages the presence of an active admin session to bypass login requirements, enabling attackers to alter router settings, potentially including DNS configurations, firewall rules, or firmware updates. Such changes can lead to full device compromise, allowing attackers to intercept or redirect network traffic, deploy malware, or establish persistent backdoors. The vulnerability does not require user interaction, and no authentication is needed for exploitation beyond network adjacency and the presence of an active admin session. Although no CVSS score has been assigned, the impact on confidentiality, integrity, and availability is severe. No known exploits are currently reported in the wild, but the risk remains significant due to the ease of exploitation and the critical role of routers in network security.

For European organizations, this vulnerability poses a significant risk to network security and data confidentiality. Compromise of the Tongyu AX1800 router could allow attackers to intercept sensitive communications, redirect traffic to malicious sites, or disrupt network availability. Enterprises relying on these routers for perimeter or internal network segmentation could face lateral movement by attackers, leading to broader network compromise. The ability to change configurations without authentication undermines trust in network infrastructure and could facilitate espionage, data theft, or ransomware deployment. Residential users and small businesses using this router model are also at risk, potentially exposing home networks and connected devices. The impact is heightened in sectors with stringent data protection requirements, such as finance, healthcare, and government, where unauthorized access could lead to regulatory penalties and reputational damage.

1. Immediately restrict access to the router's management interface to trusted network segments only, using VLANs or firewall rules to limit exposure. 2. Disable remote management features unless absolutely necessary, and if enabled, enforce strong authentication and encrypted connections (e.g., HTTPS, VPN). 3. Monitor network traffic for unusual configuration changes or access attempts to the /boaform/formSaveConfig and /boaform/admin endpoints. 4. Implement network segmentation to isolate critical infrastructure from general user networks, reducing the risk of network-adjacent attackers. 5. Regularly check for firmware updates from Tongyu and apply patches promptly once available. 6. Consider replacing vulnerable routers with models from vendors with a strong security track record if patches are delayed or unavailable. 7. Educate network administrators about the risks of leaving active admin sessions unattended and enforce session timeouts or automatic logouts. 8. Employ intrusion detection systems (IDS) or endpoint detection and response (EDR) tools to detect exploitation attempts targeting router management interfaces.