Read the docs
TI-2025-39228 Aliases CVE-2025-63080GHSA-qr3p-6238-2p49

Authenticated RCE in KAON PG5298

Priority LOW 39CWE-863Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution.    This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00285 21st percentileScored 2026-11-07
Fix Fixed PG5298A (KAON): 3.0.82PG5298B (KAON): 4.0.82

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KAONPG5298Abefore 3.0.823.0.82Patch availableCNA
KAONPG5298Bbefore 4.0.824.0.82Patch availableCNA
  • PG5298A VendorKAON Affected before 3.0.82 Fixed in 3.0.82 Patch available CNA
  • PG5298B VendorKAON Affected before 4.0.82 Fixed in 4.0.82 Patch available CNA

Remediation

  • Fix · CNA PG5298A (KAON) Fixed in 3.0.82
  • Fix · CNA PG5298B (KAON) Fixed in 4.0.82

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    KAON PG5298A, PG5298B 3.0.82, 4.0.82

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-05280 Missing Authentication for Critical Function in KAON PG5298Priority LOW 31
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-63080
  2. 2026-10-03 Alias added: GHSA-qr3p-6238-2p49

References

Advisory 1

  • TI-2024-08063 Kaon CG3000 dhcpcd Command cross site scripting CVSS 4.0MEDIUM 5.1
  • TI-2025-32314 Authentication bypass in KAON KCM3100 CVSS 4.0CRITICAL 9.3
  • TI-2025-06434 Hardcoded credentials in KAON CG3000T/CG3000CT routers CVSS 4.0CRITICAL 9.3
  • TI-2026-37866 Missing authentication for backup functionality in Kaon AR2140X CVSS 4.0HIGH 7.1
  • TI-2026-05280 Missing Authentication for Critical Function in KAON PG5298 CVSS 4.0HIGH 7.1
  • TI-2026-37867 Improper Authentication in Kaon AR2140X CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences