Threat database

The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication bypass. With this access, the attacker can perform unauthorized actions on upgrade-related functionalities. These actions can be abused to force the router to issue GET requests to arbitrarily chosen domains. This issue was identified in firmware versions up to 4.2.17. Status of newer versions remains unknown.

The Kaon AR2140X router contains a vulnerability where the backup functionality is accessible without authentication. This allows an unauthenticated remote attacker to trigger a configuration backup and retrieve it in a form encrypted by a device-specific key. Triggering this function renders the router inoperable for a substantial period of time.  This issue was identified in firmware versions up to 4.2.17. Status of newer versions remains unknown.

KAON PG5298A and PG5298B routers have a firmware vulnerability that allows an authenticated user to send crafted JSON-RPC requests to perform unauthorized operations such as reading system files or executing commands. This issue is due to incorrect authorization (CWE-863). The vulnerability is fixed in firmware versions 3.0.82 for PG5298A and 4.0.82 for PG5298B.

Firmware in KAON PG5298A and PG5298B routers contains a vulnerability that allows unauthenticated users to access a specific endpoint and retrieve sensitive information, including the administrative portal password. This security flaw is identified as CWE-306, indicating missing authentication for a critical function. The issue has been addressed in firmware versions 3.0.82 for PG5298A and 4.0.82 for PG5298B.

The firmware in KAON CG3000TC and CG3000T routers contains hard-coded credentials in clear text (shared across all routers of this model) that an unauthenticated remote attacker could use to execute commands with root privileges. This vulnerability has been fixed in firmware version: 1.00.67 for CG3000TC and 1.00.27 for CG3000T.

An authentication bypass vulnerability exists in KCM3100 Ver1.4.2 and earlier. If this vulnerability is exploited, an attacker may bypass the authentication of the product from within the LAN to which the product is connected.

Firmware in KAON AR2140 routers, prior to versions 3.2.50 and 4.2.16, is vulnerable to a shell command injection via sending a crafted request to one of the endpoints. In order to exploit this vulnerability, one has to have access to the administrative portal of the router.