KAON Router Firmware Flaws Enable RCE
Two vulnerabilities in KAON PG5298A/PG5298B router firmware allow authenticated command execution and unauthenticated credential disclosure, now patched.
CERT Polska coordinated disclosure of two vulnerabilities affecting KAON PG5298A and PG5298B router firmware, reported by researcher Oskar Rudziński. CVE-2025-63080 allows an authenticated user to send crafted JSON-RPC requests to perform actions unavailable through the normal GUI, including reading arbitrary system files and executing commands. CVE-2026-6017 allows an unauthenticated attacker to query a specific endpoint and retrieve sensitive information, including the password used for the administrative portal — which could then be chained with the first flaw or used directly to gain administrative access.
Both issues have been remediated by the vendor in firmware versions 3.0.82 (PG5298A) and 4.0.82 (PG5298B). No evidence of active exploitation is mentioned in the advisory; this is a standard coordinated vulnerability disclosure. Defenders and network operators using these KAON router models should verify firmware versions and apply the patched releases, and should restrict management interface exposure as a general hardening measure for embedded network devices of this type.
Mentioned in this report
Detection guidance
JSON-RPC Request Invoking System-Level Actions on Embedded Device Management Interface
Detects HTTP/JSON-RPC requests to a device management endpoint whose method or query parameters reference OS-level actions (command execution, arbitrary file read) that are not exposed through the normal GUI - the abuse pattern used against KAON router JSON-RPC handlers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: JSON-RPC Request Invoking System-Level Actions on Embedded Device Management
Interface
description: Detects requests to a JSON-RPC endpoint on an embedded/network-device
management interface where the method name or parameters reference shell/file-system
primitives not normally reachable via the GUI. Generalises on the JSON-RPC endpoint
plus suspicious action keywords rather than any single vendor's method name, matching
the class of abuse described for KAON router firmware (CVE-2025-63080).
tags:
- attack.initial-access
- attack.t1190
logsource:
category: proxy
product: null
detection:
selection_endpoint:
c-uri|contains: jsonrpc
cs-method: POST
selection_action:
c-uri|contains:
- cmd
- exec
- shell
- system
- readfile
- read_file
- getfile
- command
condition: selection_endpoint and selection_action
falsepositives:
- Legitimate vendor management tools or firmware update utilities that also use JSON-RPC
with similarly named diagnostic methods
- Authorized administrators using documented advanced JSON-RPC calls for support/debugging
level: medium
id: 58f545d6-b96b-5bac-8ef3-315e919f91b6
status: experimental
author: Vorant
Unauthenticated Request to Device Endpoint Disclosing Administrative Credentials
Detects unauthenticated HTTP requests to a management-interface endpoint whose response contains password/credential fields - the pattern used to retrieve the KAON router admin portal password via CVE-2026-6017 without authentication. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Request to Device Endpoint Disclosing Administrative Credentials
description: Detects requests to embedded device management endpoints made without
an authenticated session (no session cookie / auth header) whose HTTP response body
contains credential-like fields such as password. Generalises on the unauthenticated-access-plus-credential-disclosure
pattern rather than the specific vendor endpoint path, matching CVE-2026-6017 behaviour
on KAON routers.
tags:
- attack.credential-access
- attack.t1552
logsource:
category: proxy
product: null
detection:
selection_request:
cs-method: GET
sc-status: 200
filter_authenticated:
cs-cookie|contains:
- session
- auth
- token
selection_response:
r-body|contains:
- '"password"'
- admin_password
- adminPassword
condition: selection_request and selection_response and not filter_authenticated
falsepositives:
- Legitimate admin session establishment flows that legitimately return a masked/placeholder
password field on first-login
- Monitoring or backup tools that pull full device configuration exports over an authenticated
but differently-cookied session
level: high
id: 58853c90-9802-5a03-9502-68a5537c424a
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/08/CVE-2025-63080
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free