EUVD-2026-88246
GHSA-vcfv-29fp-vc3c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent-network access to router
-
DeliverySend unauthenticated backup request
-
ExploitTrigger config backup routine
-
ExecutionRetrieve device-key-encrypted config
-
ImpactRouter rendered inoperable (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network adjacency to the Kaon AR2140X (AV:A) - the attacker must be on the same LAN, Wi-Fi, or adjacent ISP access segment, not the open internet - but needs NO authentication (PR:N), NO user interaction (UI:N), and works against default configurations because the backup functionality is exposed without any access control (CWE-306). The concrete prerequisite is reachability of the unauthenticated backup endpoint on firmware versions up to 4.2.17. Limiting factors: the adjacent-network requirement bounds who can reach it; the retrieved backup is encrypted with a device-specific key, blunting direct confidentiality loss; primary realistic impact is availability (router made inoperable for a substantial period). |
| Impact | This is a genuine but geographically/segment-limited risk, not a high-CVSS-but-empty issue, though it is also not internet-wide critical. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) confirms adjacent-network, low-complexity, unauthenticated exploitation with no user interaction - meaning any device on the same LAN/Wi-Fi segment can trigger it. Impact is dominated by availability (VA:H) - the router is rendered inoperable for a substantial period - with only limited confidentiality (VC:L, since the retrieved backup is encrypted by a device-specific key) and no integrity impact. Note a discrepancy: the description calls the actor an 'unauthenticated remote attacker,' but the CVSS vector specifies AV:A (adjacent), not AV:N - true internet-facing exploitation is NOT supported by the vector, so real-world reach is bounded to the local network segment; verify with CERT-PL whether WAN-side exposure is possible. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation - this is a vendor/CERT-disclosed weakness, not a weaponized one. Priority is moderate: the missing-authentication DoS is trivially reproducible for a LAN-adjacent attacker (e.g., a guest, a compromised IoT device, or a malicious client on shared/ISP infrastructure), which raises its practical value despite the adjacent constraint. |
| Exploit ScenarioDerived | An attacker on the same local or adjacent network segment as a Kaon AR2140X (e.g., shared Wi-Fi, a compromised LAN host, or ISP access network) sends an unauthenticated request to the exposed backup endpoint. This triggers a device-specific-key-encrypted configuration backup that the attacker can retrieve, and the act of triggering it knocks the router offline for a substantial period, causing a denial of service. No public exploit code is identified at time of analysis, but the missing-authentication design makes reproduction trivial given adjacent access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Unauthenticated access to the backup function on the Kaon AR2140X router allows an attacker on an adjacent network segment to trigger a configuration export without any credentials and download the resulting file, which is protected only by a device-specific encryption key. The same action drives the router into an inoperable state for a substantial period, making availability loss the dominant realistic impact, while the device-specific backup encryption limits direct confidentiality exposure. Affected firmware is reported up to version 4.2.17, with the status of newer releases unknown; exploitation requires network adjacency (same LAN, Wi-Fi, or adjacent ISP access segment) rather than internet exposure, no authentication or user interaction is needed, and no public exploit code was identified at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis, and the CERT-PL advisory at https://cert.pl/en/posts/2026/09/CVE-2026-52748 is the reporting source; operators should contact Kaon directly or through CERT-PL to obtain a fixed firmware build and treat versions above 4.2.17 as unverified rather than safe. Until a fix is confirmed, the most effective compensating control is to remove reachability of the router's management interface from untrusted adjacent networks: place the device on a dedicated management VLAN, block inbound access to its web/management ports from guest Wi-Fi, client VLANs, and the ISP-facing segment using upstream firewall or ACL rules, and disable any remote-management or WAN-side administration option. The trade-off is a loss of convenience - administrators must reach the device from a trusted management host rather than from arbitrary clients - and on consumer or ISP-managed deployments where the operator cannot edit router-side rules, the practical alternative is to isolate the device behind a separate access point or router that enforces the filtering. Disabling or restricting the backup feature itself, if the firmware exposes such a setting, would remove the attack surface but also removes the ability to export configurations for legitimate recovery purposes. As an additional detection measure, monitor the device for unexpected reboots, prolonged unresponsiveness, or repeated requests to backup-related endpoints, all of which are consistent with this attack, and plan for out-of-band recovery of the AR2140X in case it is rendered inoperable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is classified as CWE-306 (Missing Authentication for Critical Function): the router's configuration backup routine is exposed on the management interface without any authentication or authorization check on firmware versions up to 4.2.17. Because the endpoint is unguarded, any host that can route to the device's management plane can invoke it directly. Two consequences follow. First, the backup artifact is returned to the caller, but it is encrypted with a key specific to the individual device, so a captured archive is not trivially portable to another unit and the confidentiality impact is limited rather than a full credential or configuration disclosure. Second, generating the backup is resource-intensive enough that the device becomes unresponsive for a substantial period, which is why the assessed vector rates availability impact High (A:H) while confidentiality is only Low (C:L) and integrity is unaffected. Reachability is bounded by the assessed vector AV:A/PR:N/UI:N/S:U, meaning the attacker must already sit on the same LAN, Wi-Fi, or adjacent ISP access segment as the AR2140X, but needs no account, no interaction from a legitimate user, and no non-default configuration to succeed. The product identification maps to CPE cpe:2.3:a:kaon:ar2140, covering the AR2140 family including the AR2140X.
Know when Router gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Adjacent unauthenticated access to an unprotected backup endpoint (AV:A/PR:N/AC:L); encrypted backup gives only C:L, no integrity, but triggering causes prolonged outage (A:H).
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
DescriptionCVE.org
The Kaon AR2140X router contains a vulnerability where the backup functionality is accessible without authentication. This allows an unauthenticated remote attacker to trigger a configuration backup and retrieve it in a form encrypted by a device-specific key. Triggering this function renders the router inoperable for a substantial period of time.
This issue was identified in firmware versions up to 4.2.17. Status of newer versions remains unknown.
Executive ViewAI
Kaon AR2140X routers used at branch, edge, or customer premises are exposed to a network-adjacent availability attack that can force a configuration backup export and leave the device inoperable for a substantial period. No public exploit identified at time of analysis and no vendor-released patch is available, but affected firmware is reported up to version 4.2.17, so leadership should treat this as an operational resilience and supply-chain risk for sites dependent on these routers. Impact is concentrated on service availability and incident-response load, with confidentiality exposure constrained by device-specific backup encryption.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict adjacent network access to affected Kaon AR2140X routers, segment and isolate them on dedicated VLANs, disable or block the backup/configuration export function where possible, enforce ACLs and firewall rules plus Wi-Fi client isolation, restrict physical and ISP-adjacent access, monitor for unexpected reboots or export activity, and prepare replacement or failover routers for critical sites.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote attackers can enable Telnet on TOTOLINK X5000R AX1800 routers running firmware V9.1.0u.6369_B2023
Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated
OS command injection in Netcore NAP930 firmware 0.1.241010.141410 allows unauthenticated remote attackers to execute arb
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers e
Missing authorization in Netcore NBR100V2 firmware 1.3.240614.030928 allows remote unauthenticated attackers to modify d
Authenticated administrators of ASUS routers can execute arbitrary commands on the device by uploading a crafted file th
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and ab
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can
A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated r
Unauthenticated OS command injection in the Netcore NBR200V2 router's Web Management Interface (firmware 1.3.241127.0712
Authenticated administrators of certain ASUS router models can abuse leftover debug code in the device's web management
Exploit-DB