KAON PG5298 Routers EUVD-2025-210761

Exploitation requires two prerequisites: the attacker must possess valid authentication credentials for the KAON router (the vendor CVSS 4.0 vector specifies PR:H, suggesting high-privilege credentials, though 'authenticated user' in the description is ambiguous - direct vendor confirmation is needed to determine if any authenticated session suffices), and the attacker must have adjacent network access (AV:A) to the router's management interface, meaning physical or logical LAN adjacency. The vulnerable interface is the JSON-RPC endpoint exposed by the router firmware. Devices where management interfaces are isolated to a dedicated out-of-band network, or where management access is restricted by ACL to specific administrative hosts, are not reachable by this attack path. Internet-facing exploitation is not applicable due to the adjacent-network constraint.

The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) scores 8.5, reflecting adjacent-network attack surface with high privileges required but full confidentiality, integrity, and availability impact on the vulnerable system. The AV:A constraint substantially limits the exploitable population - an attacker must have network-adjacent access to the router management interface, ruling out opportunistic internet-scale scanning. A notable tension exists in the data: the vendor CVSS 4.0 vector specifies PR:H (high privilege), but the description states only 'authenticated user,' without distinguishing between administrative and lower-privilege accounts; security teams should verify with KAON whether this affects any authenticated session or only privileged ones, as that distinction materially changes exposure. No CISA KEV listing and no public POC code exist, indicating no confirmed mass exploitation. EPSS data was not provided in available intelligence. Despite low exploitation evidence, router compromise via arbitrary command execution is particularly severe in ISP and enterprise deployments because it enables persistent backdoors and interception of all downstream traffic, making patch deployment urgent regardless of EPSS signal.

An attacker who has obtained valid router credentials - through default password use, credential reuse, or prior phishing - and is positioned on the same network segment as the router's management interface crafts a JSON-RPC request invoking a privileged operation (such as reading /etc/shadow or executing a shell command) that the GUI would normally block. The router's firmware processes the request without enforcing the same authorization checks applied by the GUI, returning sensitive file contents or executing the command with elevated privileges. No public exploit code exists at time of analysis, but the technique requires only knowledge of the JSON-RPC API schema and valid credentials.