Vulnerability · Published Sep 28, 2026 · Assigned by CERT-PL

CVE-2026-52749Improper Authentication in Kaon AR2140X

Medium 5.3

In plain English

A medium-severity improper authentication in AR2140 from Kaon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.3%top 82.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication bypass. With this access, the attacker can perform unauthorized actions on upgrade-related functionalities. These actions can be abused to force the router to issue GET requests to arbitrarily chosen domains. This issue was identified in firmware versions up to 4.2.17. Status of newer versions remains unknown.

Affected products (as reported)

Vendor	Product	Versions
Kaon	AR2140	0 – through 4.2.17

Weakness: CWE-287 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References

https://cert.pl/en/posts/2026/09/CVE-2026-52748