CVE-2025-63080: Authenticated RCE in KAON PG5298

Q: What does an attacker need to exploit this issue?

The attacker must be authenticated to the router. They can then send crafted JSON-RPC requests to perform actions unavailable through the GUI, including reading system files or executing commands.

Q: Which firmware versions contain the fix?

KAON PG5298A is fixed in firmware version 3.0.82, and KAON PG5298B is fixed in firmware version 4.0.82.

Published Aug 24, 2026

Updated

Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B.

Affected Software

2 affected components

KAON PG5298A router firmware<3.0.82

KAON PG5298B router firmware<4.0.82

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade KAON PG5298A firmware to a version that resolves this vulnerability.
Fixed in 3.0.82
Upgrade
Upgrade KAON PG5298B firmware to a version that resolves this vulnerability.
Fixed in 4.0.82

Event History

Aug 24, 2026

CVE Published

via MITRE·11:11 AM

Data Sourced

via MITRE·11:11 AM

DescriptionWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker must be authenticated to the router. They can then send crafted JSON-RPC requests to perform actions unavailable through the GUI, including reading system files or executing commands.

Which firmware versions contain the fix?