CVE-2026-52749

The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication bypass. With this access, the attacker can perform unauthorized actions on upgrade-related functionalities, including forcing the router to issue GET requests to arbitrarily chosen domains.

An attacker can gain access to administrative functions of the router without logging in and abuse them to force requests to arbitrary domains, potentially enabling further attacks or information disclosure. The issue affects firmware versions up to 4.2.17, and the status of newer versions is unknown.

Update the Kaon AR2140X router firmware to the latest available version and contact the vendor to confirm patch status. Until then, restrict access to the router's HTTP interface from untrusted networks.