Read the docs
TI-2026-05280 Aliases CVE-2026-6017GHSA-4v96-chmw-8jc6

Missing Authentication for Critical Function in KAON PG5298

Priority LOW 31CWE-306Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to the administrative portal.   This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00236 14th percentileScored 2026-11-07
Fix Fixed PG5298A (KAON): 3.0.82PG5298B (KAON): 4.0.82

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KAONPG5298Abefore 3.0.823.0.82Patch availableCNA
KAONPG5298Bbefore 4.0.824.0.82Patch availableCNA
  • PG5298A VendorKAON Affected before 3.0.82 Fixed in 3.0.82 Patch available CNA
  • PG5298B VendorKAON Affected before 4.0.82 Fixed in 4.0.82 Patch available CNA

Remediation

  • Fix · CNA PG5298A (KAON) Fixed in 3.0.82
  • Fix · CNA PG5298B (KAON) Fixed in 4.0.82

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    KAON PG5298A, PG5298B 3.0.82, 4.0.82

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-6017
  2. 2026-10-03 Alias added: GHSA-4v96-chmw-8jc6

References

Advisory 1

  • TI-2024-08063 Kaon CG3000 dhcpcd Command cross site scripting CVSS 4.0MEDIUM 5.1
  • TI-2025-32314 Authentication bypass in KAON KCM3100 CVSS 4.0CRITICAL 9.3
  • TI-2025-06434 Hardcoded credentials in KAON CG3000T/CG3000CT routers CVSS 4.0CRITICAL 9.3
  • TI-2025-39228 Authenticated RCE in KAON PG5298 CVSS 4.0HIGH 8.5
  • TI-2026-37866 Missing authentication for backup functionality in Kaon AR2140X CVSS 4.0HIGH 7.1
  • TI-2026-37867 Improper Authentication in Kaon AR2140X CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences