Resolved Authentication Bypass Vulnerability in Sophos AP6 Series Wireless Access Points Firmware (CVE-2025-10159)

Voltar à Visão geral dos comunicados de segurança
Critical
CVE
CVE-2025-10159
Updated:
Produto(s)
Sophos Wireless
ID da publicação sophos-sa-20250909-ap6
Versão do artigo 1
Primeira publicação
Solução alternativa No

Overview

Sophos has fixed an authentication bypass vulnerability in Sophos AP6 Series Wireless Access Points allowing attackers able to reach the access point’s management IP address to gain administrator level privileges. The issue was discovered by Sophos during internal security testing.

There is no action required for customers using the default updating policy, as updates are installed automatically by default.

Customers opting out of automatic updates are required to upgrade to receive this fix. See below for details.

Applies to the following product(s) and version(s)

Sophos AP6 Series Wireless Access Points firmware prior version 1.7.2563 (MR7)

Remediation

  • Ensure you are running the latest version of your Sophos AP6 Series Wireless Access Points firmware
  • Fix included in AP6 Series Wireless Access Points firmware version 1.7.2563 (MR7) after 11 August 2025
  • Users of older versions of Sophos AP6 Series Wireless Access Points firmware are required to upgrade to receive the latest protections, and this fix

Related information

 

Sophos Responsible Disclosure Policy

To learn about Sophos security vulnerability disclosure policies and publications, see the Responsible Disclosure Policy.