Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. …

Info

CVECVE-2025-63080

First seen2026-08-24 13:16 UTC

Disclosed2026-08-24 12:16 UTC

Last updated2026-08-24 13:16 UTC

Channel statusauto

Summary

Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B.

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://cert.pl/en/posts/2026/08/CVE-2025-63080/

Timeline

2026-08-24 nvd_ingest NVD