Kaon AR2140X CVE-2026-52749

Requires adjacent-network position (AV:A) - the attacker must reach the router's HTTP interface from the local LAN/Wi-Fi segment, not the public Internet. No credentials or user interaction are needed (PR:N/UI:N): the router itself issues a valid session cookie in response to an unauthenticated HTTP request, and that session grants access to upgrade-related functionality that can be coerced into issuing GET requests to arbitrary domains. Applies to firmware versions up to 4.2.17; status of newer firmware is unknown. Limiting factors: local-network adjacency requirement, limited (Low) confidentiality/integrity impact, no availability impact, and the narrow deployment base of this specific CPE model.

The vendor CVSS 4.0 base score is 5.3 (medium), and the vector is the key limiter: AV:A means the attacker must be on the adjacent/local network (LAN or Wi-Fi segment), not the open Internet - this is NOT a remotely-Internet-exploitable flaw despite being unauthenticated (PR:N/UI:N/AC:L). Impact is capped at VC:L/VI:L with a scope change to subsequent systems (SC:L/SI:L), consistent with the described outcome: an attacker obtains a valid session without credentials and abuses upgrade-related functionality to make the router issue GET requests to arbitrary domains (an SSRF/open-proxy-style primitive), rather than achieving full device compromise or code execution. No EPSS score, no CISA KEV listing, and no public POC were provided, so this maps to 'no public exploit identified at time of analysis.' Net: this is a legitimate authentication-bypass finding but a realistically LOW real-world priority - the adjacent-network requirement, limited (Low) impact, absence of exploitation signals, and the narrow/obscure device footprint all pull against urgency. One data caveat: the sole reference URL points to CVE-2026-52748 while this record is CVE-2026-52749, and the CPE lists 'ar2140' whereas the description names the 'AR2140X' - verify the exact product/reference mapping with CERT-PL.

An attacker on the same local network as the router (e.g., a guest Wi-Fi client or a compromised LAN host) sends an unauthenticated HTTP request and is issued a valid session cookie without any credentials. Using that session, the attacker invokes upgrade-related functionality to coerce the router into issuing attacker-controlled GET requests to arbitrary domains, effectively turning the device into a request proxy. No public exploit code was identified at the time of analysis.