CVE-2025-63080

HighCVSS 8.5

Published: 24/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 24/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. Fixed in firmware version 3.0.82 for PG5298A and 4.0.82 for PG5298B.

Risk Assessment

An authenticated user can gain full control over the router, including reading system files and executing commands, potentially leading to device and network compromise.

Recommendation

Update router firmware to version 3.0.82 (PG5298A) or 4.0.82 (PG5298B).

Other vulnerabilities in KAON PG5298A/PG5298B

CVE-2026-6017High
Firmware in KAON PG5298A and PG5298B routers allows an unauthenticated user to query a specific endpoint and acquire sensitive information such as the admin portal password. Fixed in firmware versions 3.0.82 (PG5298A) and 4.0.82 (PG5298B).

Original NVD description (English source)

Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B.