KAON PG5298 CVE-2026-6017

Exploitation requires the attacker to be on the same adjacent network segment as the vulnerable router - such as the same LAN, Wi-Fi SSID, or ISP-shared local segment - consistent with the CVSS 4.0 AV:A metric. Once adjacency is established, no credentials, user interaction, special configuration, or privilege escalation are required; the attack is a single unauthenticated request to a specific endpoint. Exploitation is limited by: (1) the adjacency requirement - remote internet attackers cannot exploit this without first gaining local network access via another vector; (2) the device must be running firmware prior to 3.0.82 (PG5298A) or 4.0.82 (PG5298B). The specific vulnerable endpoint URL is not publicly disclosed in available intelligence. There is no indication that the WAN interface exposes the vulnerable endpoint, and the CVSS 4.0 vector confirms no attack prerequisites beyond adjacency.

The CVSS 4.0 score of 7.1 with AV:A is the defining constraint on real-world risk: exploitation requires the attacker to already be on the same network segment as the router - the same LAN, Wi-Fi network, or equivalent adjacency. This rules out mass internet-based exploitation and substantially reduces the attacker population compared to AV:N vulnerabilities. Within that constraint, however, exploitation is maximally easy: AC:L, AT:N, PR:N, and UI:N mean no complexity, no preconditions, no credentials, and no victim interaction are required. The confidentiality impact is high (VC:H) because the disclosed credential grants full administrative access to the device. No EPSS data was provided in the available intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. For ISP-deployed residential or SMB routers, realistic threat actors include co-tenants in shared apartment buildings, users on shared Wi-Fi, or attackers who have already achieved LAN-level access via another vector. The adjacent-vector constraint makes automated internet-scale scanning infeasible, but the trivial exploitation mechanics and high-value credential output make targeted local-network attacks a meaningful risk.

An attacker connected to the same Wi-Fi network as a vulnerable KAON router - such as a neighbor exploiting a shared ISP access segment, or a guest user - sends a simple unauthenticated HTTP request to the undisclosed firmware endpoint. The router responds with the administrative portal password, which the attacker then uses to log into the management interface and gain full device control, enabling persistent DNS manipulation, traffic interception, or firmware replacement. No public exploit code is known, but the low complexity of the attack (single unauthenticated HTTP request) makes independent development trivial for any attacker with local network access.