Pg5298B
Monthly
Unauthenticated information disclosure in KAON PG5298A and PG5298B router firmware exposes the administrative portal password to any attacker on the same local network segment. An adjacent-network attacker can query a specific firmware endpoint without credentials and retrieve sensitive authentication material, enabling full device takeover. Vendor-released patches are available in firmware versions 3.0.82 (PG5298A) and 4.0.82 (PG5298B); no public exploit code or confirmed active exploitation has been identified at time of analysis.
Incorrect authorization in KAON PG5298A and PG5298B router firmware allows authenticated network-adjacent users to send crafted JSON-RPC requests that bypass GUI-enforced access controls, enabling arbitrary system file reads and command execution on the device. All firmware versions prior to 3.0.82 (PG5298A) and 4.0.82 (PG5298B) are affected, as confirmed by CERT-PL. No public exploit has been identified at time of analysis; vendor-released patches are available.
Unauthenticated information disclosure in KAON PG5298A and PG5298B router firmware exposes the administrative portal password to any attacker on the same local network segment. An adjacent-network attacker can query a specific firmware endpoint without credentials and retrieve sensitive authentication material, enabling full device takeover. Vendor-released patches are available in firmware versions 3.0.82 (PG5298A) and 4.0.82 (PG5298B); no public exploit code or confirmed active exploitation has been identified at time of analysis.
Incorrect authorization in KAON PG5298A and PG5298B router firmware allows authenticated network-adjacent users to send crafted JSON-RPC requests that bypass GUI-enforced access controls, enabling arbitrary system file reads and command execution on the device. All firmware versions prior to 3.0.82 (PG5298A) and 4.0.82 (PG5298B) are affected, as confirmed by CERT-PL. No public exploit has been identified at time of analysis; vendor-released patches are available.