Read the docs
TI-2025-06434 Aliases CVE-2025-7072GHSA-c223-65f8-3p5p

Hardcoded credentials in KAON CG3000T/CG3000CT routers

Priority MEDIUM 49CWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

The firmware in KAON CG3000TC and CG3000T routers contains hard-coded credentials in clear text (shared across all routers of this model) that an unauthenticated remote attacker could use to execute commands with root privileges. This vulnerability has been fixed in firmware version: 1.00.67 for CG3000TC and 1.00.27 for CG3000T.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00551 46th percentileScored 2026-11-07
Fix Fixed CG3000T (KAON): 1.00.27CG3000TC (KAON): 1.00.67

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KAONCG3000Tbefore 1.00.271.00.27Patch availableCNA
KAONCG3000TCbefore 1.00.671.00.67Patch availableCNA
  • CG3000T VendorKAON Affected before 1.00.27 Fixed in 1.00.27 Patch available CNA
  • CG3000TC VendorKAON Affected before 1.00.67 Fixed in 1.00.67 Patch available CNA

Remediation

  • Fix · CNA CG3000T (KAON) Fixed in 1.00.27
  • Fix · CNA CG3000TC (KAON) Fixed in 1.00.67

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-7072
  2. 2026-10-03 Alias added: GHSA-c223-65f8-3p5p

References

Advisory 1

  • TI-2024-08063 Kaon CG3000 dhcpcd Command cross site scripting CVSS 4.0MEDIUM 5.1
  • TI-2025-32314 Authentication bypass in KAON KCM3100 CVSS 4.0CRITICAL 9.3
  • TI-2025-39228 Authenticated RCE in KAON PG5298 CVSS 4.0HIGH 8.5
  • TI-2026-37866 Missing authentication for backup functionality in Kaon AR2140X CVSS 4.0HIGH 7.1
  • TI-2026-05280 Missing Authentication for Critical Function in KAON PG5298 CVSS 4.0HIGH 7.1
  • TI-2026-37867 Improper Authentication in Kaon AR2140X CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences