Skip to main content

Unverified Password Change

CVE-2025-10159

High
9.8/10

Summary

An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points older than firmware version 1.7.2563 (MR7).

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-620 - Unverified Password Change

When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

References

Advisory Timeline

  • Published