Sophos Wireless Access Point Vulnerability Allows Attackers to Bypass Authentication

According to Sophos, a critical authentication bypass vulnerability has been identified in the AP6 Series Wireless Access Points, with exploitation possible by an attacker who can reach the device’s management interface. The flaw is tracked as CVE-2025-10159 and affects firmware versions prior to 1.7.2563 (MR7). An attacker with network access to the management IP can bypass authentication checks and gain elevated, potentially full administrator privileges.

Sophos has issued a firmware update to address the issue, which is bundled in version 1.7.2563 (MR7) released on 11 August 2025; customers using the default automatic update policy will receive the fix automatically. For those with automatic updates disabled, manual installation of the new firmware is required.

The vulnerability could enable unauthorised changes to wireless settings, network segmentation rules, or logging configurations, and misconfigured networks or exposed management ports may leave devices exposed to unauthorised access from inside or outside an organisation. No workaround exists beyond applying the update.