Full Report
CERT Polska has received a report about 2 vulnerabilities (CVE-2025-63080 and CVE-2026-6017) found in KAON PG5298A/PG5298B routers.
Analysis Summary
# Vulnerability: Multiple Flaws in KAON PG5298A/PG5298B Routers
## CVE Details
**Vulnerability 1**
- CVE ID: CVE-2025-63080
- CVSS Score: Not explicitly provided in the source (Severity: High, based on RCE capabilities)
- CWE: CWE-863 (Incorrect Authorization)
**Vulnerability 2**
- CVE ID: CVE-2026-6017
- CVSS Score: Not explicitly provided in the source (Severity: Critical, based on authentication bypass)
- CWE: CWE-306 (Missing Authentication for Critical Function)
## Affected Systems
- **Products:** KAON Routers PG5298A and PG5298B
- **Versions:**
- PG5298A: All versions prior to 3.0.82
- PG5298B: All versions prior to 4.0.82
- **Configurations:** Default installations using vulnerable firmware versions.
## Vulnerability Description
Two distinct vulnerabilities allow for information disclosure and remote code execution:
1. **CVE-2025-63080:** An authenticated user can bypass GUI restrictions by sending specially crafted JSON-RPC requests. This allows the attacker to perform unauthorized operations, including reading sensitive system files and executing arbitrary commands.
2. **CVE-2026-6017:** A critical lack of authentication on a specific endpoint allows any unauthenticated user to query the device and retrieve sensitive data, including the administrative portal password.
## Exploitation
- **Status:** PoC available (reported via coordinated disclosure; exploitation in the wild not confirmed in the text).
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** Total (Exposure of admin passwords and system files).
- **Integrity:** Total (Ability to execute system commands).
- **Availability:** High (Potential for device takeover or bricking via command execution).
## Remediation
### Patches
KAON has released firmware updates to address these flaws. Users should update to the following versions immediately:
- **PG5298A:** Firmware version **3.0.82** or later.
- **PG5298B:** Firmware version **4.0.82** or later.
### Workarounds
- Disable remote management interfaces (WAN-side access) to the router’s administrative portal.
- Ensure the local network is restricted to trusted users only.
- Change administrative passwords immediately after patching.
## Detection
- **Indicators of Compromise:** Unusual JSON-RPC traffic directed at the router; unauthorized changes to router configuration or system settings.
- **Detection methods and tools:** Audit web server logs for unauthorized access to internal endpoints; scan for exposed administrative interfaces on the network.
## References
- CERT Polska Advisory: hxxps[://]cert[.]pl/en/posts/2026/08/cve-2025-63080/ (Note: based on provided summary link)
- CVE-2025-63080: hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2025-63080
- CVE-2026-6017: hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-6017
- CERT Polska CVD Policy: hxxps[://]cert[.]pl/en/cvd/