Ar2140
Monthly
Unauthenticated access to the backup function on the Kaon AR2140X router allows an attacker on an adjacent network segment to trigger a configuration export without any credentials and download the resulting file, which is protected only by a device-specific encryption key. The same action drives the router into an inoperable state for a substantial period, making availability loss the dominant realistic impact, while the device-specific backup encryption limits direct confidentiality exposure. Affected firmware is reported up to version 4.2.17, with the status of newer releases unknown; exploitation requires network adjacency (same LAN, Wi-Fi, or adjacent ISP access segment) rather than internet exposure, no authentication or user interaction is needed, and no public exploit code was identified at time of analysis.
Authentication bypass in Kaon AR2140X routers (firmware versions up to 4.2.17) allows unauthenticated attackers on the adjacent network to obtain a valid session cookie and access upgrade-related functionality, which can be abused to force the device to issue GET requests to arbitrary domains. The flaw requires local LAN or Wi-Fi adjacency (AV:A) and carries low confidentiality/integrity impact with no availability impact; no public exploit has been identified, and the status of firmware newer than 4.2.17 remains unknown.
Unauthenticated access to the backup function on the Kaon AR2140X router allows an attacker on an adjacent network segment to trigger a configuration export without any credentials and download the resulting file, which is protected only by a device-specific encryption key. The same action drives the router into an inoperable state for a substantial period, making availability loss the dominant realistic impact, while the device-specific backup encryption limits direct confidentiality exposure. Affected firmware is reported up to version 4.2.17, with the status of newer releases unknown; exploitation requires network adjacency (same LAN, Wi-Fi, or adjacent ISP access segment) rather than internet exposure, no authentication or user interaction is needed, and no public exploit code was identified at time of analysis.
Authentication bypass in Kaon AR2140X routers (firmware versions up to 4.2.17) allows unauthenticated attackers on the adjacent network to obtain a valid session cookie and access upgrade-related functionality, which can be abused to force the device to issue GET requests to arbitrary domains. The flaw requires local LAN or Wi-Fi adjacency (AV:A) and carries low confidentiality/integrity impact with no availability impact; no public exploit has been identified, and the status of firmware newer than 4.2.17 remains unknown.