CVE-2025-10159 - An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points older than firmware version 1.7.2563 (MR7)

Back Back to CVE browser

CRITICAL

An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points older than firmware version 1.7.2563 (MR7)

Published Sep 9, 2025

9.8

CRITICAL

CVSS 3.1

EPSS 0.88%

Description

An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points older than firmware version 1.7.2563 (MR7).

Affected products

Vendor Sophos Product AP6 Series Wireless Access Points Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.7.2563 (MR7)

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Sophos

AP6 Series Wireless Access Points

unaffected

Version	Status	Constraints
0	affected	<1.7.2563 (MR7)

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-620

References (1)

https://www.sophos.com/en-us/security-advisories/sophos-sa-20250909-ap6

Link	Providers	Tags
https://www.sophos.com/en-us/security-advisories/sophos-sa-20250909-ap6

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Sophos

Published Sep 9, 2025

Updated Sep 10, 2025

Reserved Sep 9, 2025

Link CVE-2025-10159

CISA Vulnrichment

Updated Sep 10, 2025

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-10159

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-10159