Introduction
CVE-2025-10159 is a critical authentication bypass in Sophos AP6 Series Wireless Access Points. On devices running outdated firmware, a remote attacker can skip authentication entirely and take full administrative control of enterprise Wi-Fi infrastructure. The vulnerability has a CVSS score of 9.8 and affects a widely deployed family of Wi-Fi 6 and Wi-Fi 6E access points used in business environments.
About Sophos and the AP6 Series: Sophos is a global cybersecurity vendor whose products include endpoint, firewall, and wireless security. The AP6 Series is its flagship line of enterprise Wi-Fi 6 and Wi-Fi 6E access points. Organizations that want unified security management for their wireless networks deploy them and manage them through Sophos Central or a local interface.
Technical Information
CVE-2025-10159 is an authentication bypass vulnerability classified under CWE-620 (Unverified Password Change). The flaw is in the management interface of Sophos AP6 Series Wireless Access Points running firmware versions older than 1.7.2563 (MR-7).
A remote attacker can send crafted requests to the access point's web management interface or its associated API endpoints. Because the device does not sufficiently verify password change or authentication operations, the attacker can bypass credential checks and set a new administrative password, or gain administrative access some other way. The attack needs neither physical access nor prior authentication.
With administrative access, an attacker can:
- Change wireless network configurations
- Intercept or redirect wireless traffic
- Deploy rogue SSIDs or backdoors
- Disable security features or monitoring
The root cause is that the management interface does not properly validate the identity of users who perform sensitive operations, specifically password changes (CWE-620). No code snippets or further exploit details are publicly available at the time of writing.
Affected Systems and Versions
- Sophos AP6 Series Wireless Access Points
- All models, including AP6 420, AP6 420E, AP6 420X, AP6 840, AP6 840E
- Firmware versions older than 1.7.2563 (MR-7) are vulnerable
- Devices managed through Sophos Central or the local web interface are affected
Vendor Security History
Sophos has fixed critical vulnerabilities in its network products before. CVE-2022-1040, for example, was a similar authentication bypass in Sophos Firewall. The vendor usually issues patches and advisories quickly, but repeated authentication bypass flaws point to ongoing problems with secure development in its network infrastructure products.
