CVE-2025-63080 in PG5298A
Summary
by MITRE • 08/24/2026
Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The KAON PG5298A and PG5298B routers contain a firmware implementation flaw that allows authenticated users to execute unauthorized operations through the JSON-RPC interface. While these devices provide a graphical user interface (GUI) for administrative tasks, the underlying API exposes functionality that is either restricted or entirely absent from the front-end controls. This discrepancy creates an authorization bypass scenario where an attacker who has obtained valid credentials can leverage specific crafted requests to interact with system components in ways not intended by the manufacturer's design. The vulnerability stems from a failure to enforce consistent access control policies across different interfaces, allowing operations that should be blocked or hidden via the GUI to be executed directly through the API endpoint.
From a technical perspective, this flaw is classified as an improper privilege escalation or broken access control issue, aligning with CWE-269 (Improper Privilege Control) and CWE-732 (Incorrect Permission Assignment for Critical Resource). The JSON-RPC interface serves as a programmatic entry point into the router's management system. By sending specifically crafted requests to this endpoint, an authenticated user can bypass standard GUI restrictions. This capability enables actions such as reading sensitive system files or executing arbitrary commands on the device. Such capabilities are typically reserved for high-level administrative functions and should not be accessible through general-purpose interfaces without additional verification steps that match the security level of the action being performed.
The operational impact of this vulnerability is significant, particularly in environments where router credentials may be compromised or shared among multiple users with varying levels of trust. If an attacker gains access to a user account with limited privileges via the GUI, they can still achieve full system control by switching to the JSON-RPC interface. The ability to read arbitrary files could lead to the exposure of configuration data, private keys, or other sensitive information stored on the device. Furthermore, command execution capabilities allow for complete compromise of the router's integrity and confidentiality. This effectively turns a standard user account into an administrative one, facilitating further attacks such as network pivoting, traffic interception, or using the compromised router as part of a botnet.
This type of vulnerability is often associated with ATT&CK technique T1078 (Valid Accounts), where attackers use legitimate credentials to maintain access and perform actions beyond their intended scope. It also relates to T1546.003 (Windows or Linux Utility: Event Triggered Execution) if the command execution leads to persistent backdoors, although in this context it is more directly related to unauthorized API usage. The root cause lies in the development process where backend APIs are not subjected to the same rigorous access control testing as frontend interfaces. Developers may assume that restricting functionality in the GUI is sufficient for security, failing to recognize that programmatic interfaces require independent and equally strict permission checks.
Mitigation strategies primarily involve applying the vendor-provided firmware updates immediately. For PG5298A devices, version 3.0.82 contains the fix, while PG5298B users must upgrade to version 4.0.82 or later. These patches likely implement stricter validation logic within the JSON-RPC handler to ensure that operations are only permitted if they align with the user's assigned role and permissions defined in the system database. In addition to updating firmware, administrators should enforce strong password policies and limit access to management interfaces where possible. Network segmentation can also help contain potential damage by isolating IoT devices from critical network segments. Regular audits of API endpoints for consistency between GUI restrictions and backend capabilities are essential to prevent similar discrepancies in future deployments.