Summary
- CVE-2026-6017 can expose sensitive information, including an administrative portal password, without authentication.
- CVE-2025-63080 allows an authenticated user to perform operations including system-file reading or command execution.
- KAON has fixed the vulnerabilities in firmware 3.0.82 and 4.0.82 for the affected router models.
Two vulnerabilities in KAON broadband routers can expose administrative credentials or enable command execution, creating a direct route from weaknesses in an edge device into the management plane of the equipment.
CERT Polska disclosed the issues on 24 August after coordinating reports affecting the KAON PG5298A and PG5298B. Both vulnerabilities have been fixed in updated firmware.
The more direct authentication problem, CVE-2026-6017, is classified as missing authentication for a critical function. CERT Polska said an unauthenticated user can query a particular endpoint and retrieve sensitive information, including a password used for the administrative portal.
CVE-2025-63080 concerns incorrect authorisation. An attacker who is already authenticated can send crafted JSON-RPC requests and carry out functions that are not normally available through the graphical interface, including reading system files or executing commands.
The flaws affect PG5298A firmware before version 3.0.82 and PG5298B firmware before 4.0.82. Those versions contain the fixes coordinated through the disclosure process.
Neither CERT Polska’s advisory nor the associated disclosure establishes that the vulnerabilities are being actively exploited. The distinction is important: the issues provide potentially serious technical capabilities, but there is currently no public evidence in the advisory of a campaign using them against deployed routers.
Routers nevertheless occupy an unusually sensitive position in an organisation or household network. They sit at the boundary between local systems and external connectivity, and their administrative interfaces control functions that can influence routing, configuration, DNS behaviour and network access. A flaw that exposes an administrator password therefore has consequences beyond the confidentiality of a single credential.
The two vulnerabilities also illustrate why authentication and authorisation need to be considered separately in embedded products. One issue allows an unauthenticated user to reach information that should require authentication, while the other allows a legitimate authenticated session to cross intended privilege boundaries and invoke operations hidden from the ordinary interface.
That distinction can easily disappear in product-security discussions where a device is treated as safe simply because its web interface is password protected. Management APIs, JSON-RPC endpoints and background services often expose a much broader set of functions than the visible interface, and security controls need to hold across those paths as well.
The remediation position is comparatively clear. Operators of affected KAON devices need firmware at or above 3.0.82 for the PG5298A and 4.0.82 for the PG5298B. Where routers are supplied and managed by a broadband provider rather than directly by the end user, the ability to apply those releases may depend on the provider’s own firmware deployment process.
The disclosure comes as European product-security rules increasingly shift attention towards the lifecycle of connected products rather than only the security state at the point of sale. Vulnerability handling, supported firmware and a reliable route for security updates are becoming part of the accountability question for network equipment that may remain deployed for years.
