Loading story…
CERT Polska disclosed two vulnerabilities in Kaon AR2140 router firmware through version 4.2.17: CVE-2026-52748 and CVE-2026-52749. The first exposes backup functionality without authentication, enabling a remote attacker to retrieve a configuration backup encrypted with a device-specific key; requests can also leave the device inoperable for a substantial period.
CVE-2026-52749 causes unauthenticated HTTP responses to issue session cookies, allowing a remote attacker to obtain a valid session identifier and bypass authentication. An attacker can then access upgrade-related functions, including inducing the router to send GET requests to attacker-controlled domains. The security status of firmware releases newer than 4.2.17 remains unknown.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
CERT Polska published CVE-2026-52748 and CVE-2026-52749, responsibly reported by Sebastian Jeż, affecting Kaon AR2140 firmware through version 4.2.17. CVE-2026-52748 exposes backup functionality without authentication and can leave a device inoperable, while CVE-2026-52749 can issue a valid session cookie to unauthenticated users, enabling authentication bypass and unauthorized upgrade-related actions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT Polska disclosed two vulnerabilities in **KAON PG5298A** and **PG5298B** routers that could expose sensitive data and enable unauthorized actions. The flaws, tracked as `CVE-2025-63080` and `CVE-2026-6017`, affect all PG5298A firmware versions before **3.0.82** and all PG5298B firmware versions before **4.0.82**. `CVE-2026-6017` is a missing authentication issue that lets an unauthenticated attacker query a specific endpoint and retrieve sensitive information, including the administrative portal password. CERT Polska said `CVE-2025-63080` is an incorrect authorization flaw that allows an authenticated user to send crafted JSON-RPC requests to perform actions not exposed in the web interface, including reading system files or executing commands. KAON has released fixes in firmware **3.0.82** for PG5298A and **4.0.82** for PG5298B, and the disclosure credits researcher **Oskar Rudziński** for responsibly reporting the issues.
Aug 25, 2026
STAR Labs disclosed two vulnerabilities in the Askey AP5100W Wi-Fi mesh node that can let attackers on the local network gain administrative access and retrieve sensitive configuration data. In `CVE-2020-25546`, the web management interface was found to use a flawed authentication design that appears to set a global authenticated state after any successful login, rather than creating a user-specific session. Because the interface reportedly uses no session keys or cookies, a second user on the network may be able to access administrative functions once a legitimate administrator has logged in. In `CVE-2020-25545`, the same device was reported to expose configuration backups containing sensitive data, including the admin password and Wi-Fi password. An authenticated attacker can generate and download the backup archive, and STAR Labs said that if a backup file already exists, it may be possible to retrieve it without authentication in a worst-case scenario. The researchers tested the issues on firmware `Dual_SIG_1.01.071` and said the product had been supplied to Singtel broadband customers, while repeated disclosure attempts to Askey, CSA, Singtel, and MITRE reportedly received limited or no vendor response.
Jun 29, 2026
Zyxel's **WAH7601** portable 4G router is affected by a set of four vulnerabilities, including the critical unauthenticated OS command injection flaw **`CVE-2026-13206`** and the high-severity credential exposure issue **`CVE-2026-12984`**. According to TR-CERT advisory **`TR-26-0799`**, all four flaws affect firmware through build **`20072026`**. The command injection bug is remotely exploitable and carries a **CVSS 9.8** score, while the credential issue, scored **CVSS 8.2**, can allow unauthorized retrieval of embedded sensitive data. The reported impact includes **root-level remote code execution**, credential theft, traffic interception, persistence on the device, and possible pivoting into internal networks after compromise. Public reporting said no active exploitation had been observed, but also noted that the vulnerabilities were **unpatched** at disclosure time. Recommended defenses include updating to the latest firmware if available, applying any vendor fixes, restricting or removing internet exposure of the management interface, strengthening access credentials, and replacing the device if access cannot be adequately controlled.
Aug 11, 2026