Which versions of KAON PG5298 Routers are affected by CVE-2025-63080?

KAON router firmware versions PG5298A and PG5298B contain an authorization bypass vulnerability (CVSS 8.5) that enables authenticated network users to read arbitrary system files and execute commands…. A patch is available.

How to fix or mitigate CVE-2025-63080?

Within 24 hours: inventory all KAON PG5298A and PG5298B devices across your network infrastructure and identify current firmware versions; establish a prioritized patching list for devices in critical network segments. Within 7 days: begin staged firmware updates to version 3.0.82 or later (PG5298A) or 4.0.82 or later (PG5298B), starting with edge devices and management-tier routers, and apply network segmentation to restrict JSON-RPC API access to trusted administrative networks only. Within 30 days: complete firmware updates on all affected devices and disable GUI-based JSON-RPC access where operationally feasible, replacing with command-line authentication controls.

KAON PG5298 Routers CVE-2025-63080

Q: What is the CVSS score of CVE-2025-63080?

CVE-2025-63080 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2025-210761 HIGH

Incorrect Authorization (CWE-863)

2026-08-24 CERT-PL

GHSA-qr3p-6238-2p49

Authentication Bypass Pg5298A Pg5298B

8.5

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

8.5 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.0 HIGH

Adjacent network and authenticated access required; PR:L used because description states 'authenticated user' without confirming high-privilege requirement, pending vendor clarification; full C/I/A from file read and command execution.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 24, 2026 - 12:01 EUVD

Analysis Generated

Aug 24, 2026 - 11:51 vuln.today

CVE Published

Aug 24, 2026 - 11:11 cve.org

HIGH 8.5

DescriptionCVE.org

Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B.

AnalysisAI

Incorrect authorization in KAON PG5298A and PG5298B router firmware allows authenticated network-adjacent users to send crafted JSON-RPC requests that bypass GUI-enforced access controls, enabling arbitrary system file reads and command execution on the device. All firmware versions prior to 3.0.82 (PG5298A) and 4.0.82 (PG5298B) are affected, as confirmed by CERT-PL. No public exploit has been identified at time of analysis; vendor-released patches are available.

Technical ContextAI

KAON PG5298A and PG5298B are carrier-grade or ISP-deployed routers whose firmware exposes a JSON-RPC interface for programmatic device management. CWE-863 (Incorrect Authorization) identifies the root cause: the firmware fails to enforce adequate authorization checks on JSON-RPC operations, allowing authenticated users to invoke privileged functions that the web GUI correctly restricts. This is a classic API-vs-GUI authorization mismatch - the GUI layer implements role-based restrictions that the underlying JSON-RPC handler does not replicate, creating an authorization bypass path through direct API access. Affected CPEs are cpe:2.3:a:kaon:pg5298a:*:*:*:*:*:*:*:* and cpe:2.3:a:kaon:pg5298b:*:*:*:*:*:*:*:*, covering all pre-patch firmware versions on both hardware variants.

RemediationAI

Upgrade PG5298A firmware to version 3.0.82 or later and PG5298B firmware to version 4.0.82 or later; these versions are confirmed as the fixes per the CVE description and CERT-PL advisory at https://cert.pl/en/posts/2026/08/CVE-2025-63080/. As a compensating control while patching, restrict network access to the router's management interface (including the JSON-RPC endpoint) at the network layer, permitting connections only from dedicated management hosts or out-of-band management VLANs - this directly addresses the AV:A attack vector by reducing adjacency. Disabling or firewalling the web management interface entirely from untrusted LAN segments is a high-efficacy mitigation with the trade-off of requiring out-of-band or console access for configuration changes. Review access logs for unexpected JSON-RPC requests that do not correspond to normal GUI-driven activity as an indicator of exploitation attempts.