CERT Polska published an advisory on 24 August covering two vulnerabilities in KAON PG5298A and PG5298B routers, one of which lets somebody who has never logged in retrieve the password to the router's administrative portal.
That is the whole attack. Query one endpoint, read the password out of the reply.
One endpoint gives up the admin password
CVE-2026-6017 is classed as missing authentication for a critical function (CWE-306). CERT Polska's description is short and specific: firmware in the two router models lets an unauthenticated user query a particular endpoint and acquire sensitive information, including a password to the administrative portal. The advisory publishes no CVSS score for it, and it does not report the flaw being exploited.
The second flaw picks up where the first ends
CVE-2025-63080 is an incorrect authorization issue (CWE-863). Per the same advisory, an authenticated user can send crafted JSON-RPC requests to perform operations that are not possible through the web interface, with system file reads and command execution given as the examples. JSON-RPC is the message format the router's own management pages use to talk to its firmware; the problem is that the firmware honours requests the interface would never send.
Read the two together and the sequencing is hard to miss. The advisory says one flaw hands an unauthenticated party administrative credentials, and the other says an authenticated party can read files and run commands. CERT Polska does not describe them being chained, and no exploitation is reported, but they are worth treating as one job rather than two.
Update to 3.0.82, or 4.0.82
Both issues affect all firmware before 3.0.82 on the PG5298A and all firmware before 4.0.82 on the PG5298B, and both are fixed in those releases. The advisory offers no workaround, so the firmware update is the fix. If your unit came from an internet provider, that update usually arrives centrally rather than through anything you do, which makes the practical step checking the version the admin interface reports and chasing the provider if it is older than the fixed build.
The flaws were reported to CERT Polska by Oskar Rudzinski, credited in the original advisory, and the team coordinated disclosure with the vendor under its published coordinated vulnerability disclosure process.
Why the small advisories matter
Consumer and small business routers rarely attract the attention a server product does, yet they sit permanently on the internet holding credentials that unlock everything behind them. That gear has been a standing target: twelve nations warned last month that Russian state operators were hijacking weakly secured routers, and researchers have documented botnets assembled out of thousands of ageing units. CERT Polska has been working steadily through reports of this kind, including font parsing flaws in Emacs on Android earlier this month.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.