Vulnerability · Published Jan 9, 2026 · Assigned by CERT-PL

CVE-2025-7072Hardcoded credentials in KAON CG3000T/CG3000CT routers

Critical 9.3

In plain English

A critical-severity hard-coded credentials in CG3000T from KAON. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.6%top 53.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The firmware in KAON CG3000TC and CG3000T routers contains hard-coded credentials in clear text (shared across all routers of this model) that an unauthenticated remote attacker could use to execute commands with root privileges. This vulnerability has been fixed in firmware version: 1.00.67 for CG3000TC and 1.00.27 for CG3000T.

Affected products (as reported)

Vendor	Product	Versions
KAON	CG3000T	0 – before 1.00.27
KAON	CG3000TC	0 – before 1.00.67

Weakness: CWE-798 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://cert.pl/posts/2026/01/CVE-2025-7072/ third-party-advisory