KAON Router Firmware Flaws Enable RCE
Two vulnerabilities in KAON PG5298A/PG5298B router firmware allow authenticated command execution and unauthenticated credential disclosure, now patched.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of two vulnerabilities affecting KAON PG5298A and PG5298B router firmware, reported by researcher Oskar Rudziński. CVE-2025-63080 allows an authenticated user to send crafted JSON-RPC requests to perform actions unavailable through the normal GUI, including reading arbitrary system files and executing commands. CVE-2026-6017 allows an unauthenticated attacker to query a specific endpoint and retrieve sensitive information, including the password used for the administrative portal — which could then be chained with the first flaw or used directly to gain administrative access.
Both issues have been remediated by the vendor in firmware versions 3.0.82 (PG5298A) and 4.0.82 (PG5298B). No evidence of active exploitation is mentioned in the advisory; this is a standard coordinated vulnerability disclosure. Defenders and network operators using these KAON router models should verify firmware versions and apply the patched releases, and should restrict management interface exposure as a general hardening measure for embedded network devices of this type.
Mentioned in this report
Detection guidance
JSON-RPC Request Invoking System-Level Actions on Embedded Device Management Interface
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP/JSON-RPC requests to a device management endpoint whose method or query parameters reference OS-level actions (command execution, arbitrary file read) that are not exposed through the normal GUI - the abuse pattern used against KAON router JSON-RPC handlers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: JSON-RPC Request Invoking System-Level Actions on Embedded Device Management
Interface
description: Detects requests to a JSON-RPC endpoint on an embedded/network-device
management interface where the method name or parameters reference shell/file-system
primitives not normally reachable via the GUI. Generalises on the JSON-RPC endpoint
plus suspicious action keywords rather than any single vendor's method name, matching
the class of abuse described for KAON router firmware (CVE-2025-63080).
tags:
- attack.initial-access
- attack.t1190
logsource:
category: proxy
product: null
detection:
selection_endpoint:
c-uri|contains: jsonrpc
cs-method: POST
selection_action:
c-uri|contains:
- cmd
- exec
- shell
- system
- readfile
- read_file
- getfile
- command
condition: selection_endpoint and selection_action
falsepositives:
- Legitimate vendor management tools or firmware update utilities that also use JSON-RPC
with similarly named diagnostic methods
- Authorized administrators using documented advanced JSON-RPC calls for support/debugging
level: medium
id: 58f545d6-b96b-5bac-8ef3-315e919f91b6
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/08/CVE-2025-63080
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs