Loading story…
CERT Polska disclosed two vulnerabilities in KAON PG5298A and PG5298B routers that could expose sensitive data and enable unauthorized actions. The flaws, tracked as CVE-2025-63080 and CVE-2026-6017, affect all PG5298A firmware versions before 3.0.82 and all PG5298B firmware versions before 4.0.82. CVE-2026-6017 is a missing authentication issue that lets an unauthenticated attacker query a specific endpoint and retrieve sensitive information, including the administrative portal password.
CERT Polska said CVE-2025-63080 is an incorrect authorization flaw that allows an authenticated user to send crafted JSON-RPC requests to perform actions not exposed in the web interface, including reading system files or executing commands. KAON has released fixes in firmware 3.0.82 for PG5298A and 4.0.82 for PG5298B, and the disclosure credits researcher Oskar Rudziński for responsibly reporting the issues.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CERT Polska disclosed CVE-2025-63080 and CVE-2026-6017 affecting KAON PG5298A and PG5298B routers, and noted it coordinated the disclosure after receiving a responsible report from Oskar Rudziński. The disclosure described one incorrect authorization flaw enabling file read or command execution for authenticated users and one missing authentication flaw exposing sensitive information, including the admin portal password, to unauthenticated users.
KAON fixed CVE-2025-63080 and CVE-2026-6017 in firmware version 3.0.82 for PG5298A and 4.0.82 for PG5298B. The flaws affect earlier firmware versions on both router models.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecert.pl
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT Polska disclosed two vulnerabilities in Kaon AR2140 router firmware through version 4.2.17: `CVE-2026-52748` and `CVE-2026-52749`. The first exposes backup functionality without authentication, enabling a remote attacker to retrieve a configuration backup encrypted with a device-specific key; requests can also leave the device inoperable for a substantial period. `CVE-2026-52749` causes unauthenticated HTTP responses to issue session cookies, allowing a remote attacker to obtain a valid session identifier and bypass authentication. An attacker can then access upgrade-related functions, including inducing the router to send GET requests to attacker-controlled domains. The security status of firmware releases newer than 4.2.17 remains unknown.
Sep 28, 2026
Two Totolink router models, **A7100RU** and **A8000RU**, were disclosed with critical OS command injection vulnerabilities in the CGI handler endpoint `/cgi-bin/cstecgi.cgi`. The flaws affect the `setVpnPassCfg` function and stem from improper handling of the `pptpPassThru` argument, allowing attackers to inject operating system commands remotely. The issues were assigned **CVE-2026-5850** for the A7100RU running firmware `7.4cu.2313_b20191024` and **CVE-2026-7037** for the A8000RU running firmware `7.1cu.643_b20200521`. Both vulnerabilities are classified under **CWE-78** and **CWE-77**, and were reported as remotely exploitable without privileges or user interaction. The disclosures indicate that **public exploits are available**, materially raising the risk of opportunistic compromise of exposed devices. Severity scoring across **CVSS v2**, **CVSS v3.1**, and **CVSS v4.0** places the flaws at critical or maximum-impact levels, making internet-facing Totolink routers running the affected firmware high-priority targets for remediation or isolation.
Jun 29, 2026
Two critical vulnerabilities, **CVE-2026-5851** and **CVE-2026-5976**, were disclosed in the **Totolink A7100RU** router running firmware `7.4cu.2313_b20191024`, exposing the device to remote **OS command injection** without authentication or user interaction. Both flaws affect `/cgi-bin/cstecgi.cgi` in the router's CGI handler: CVE-2026-5851 is tied to the `setUPnPCfg` function through the `enable` argument, while CVE-2026-5976 affects the `setStorageCfg` function through the `sambaEnabled` argument. The vulnerabilities were classified under **CWE-78** and **CWE-77** and were assigned high to critical severity across CVSS versions, reflecting potential compromise of confidentiality, integrity, and availability. Public exploit information has reportedly been released, including references to **VulDB** and a **GitHub** disclosure repository, increasing the likelihood of exploitation against exposed devices that have not been updated or otherwise mitigated.
Jun 29, 2026