CVE-2026-6017 in PG5298A
Summary
by MITRE • 08/24/2026
Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to the administrative portal. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The KAON PG5298A and PG5298B routers contain a critical security flaw within their firmware that permits unauthenticated actors to extract sensitive credentials, specifically the administrative portal password. This vulnerability stems from an insecure direct object reference or improper access control mechanism on a specific network endpoint exposed by the device's web interface. By querying this particular API or page without providing valid authentication tokens, an attacker can retrieve plaintext or easily decodable administrative passwords stored within the router’s configuration database. The existence of such an information disclosure vector indicates that the firmware fails to enforce proper authorization checks before serving sensitive data, allowing any entity with network connectivity to bypass security controls and gain insight into privileged account details.
From a technical perspective, this flaw aligns closely with CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, as well as CWE-862: Missing Authorization. The vulnerability likely resides in the backend logic handling administrative queries, where the system trusts client input or endpoint structure without verifying if the requester possesses the necessary privileges. In many embedded devices, such endpoints are sometimes left enabled for diagnostic purposes or due to oversight during development, creating a persistent attack surface. An attacker can automate requests to this endpoint using standard HTTP tools or custom scripts, extracting the password in seconds with minimal effort and no prior authentication required. This represents a severe breakdown in the principle of least privilege and secure default configurations expected in network infrastructure devices.
The operational impact of this vulnerability is significant because it effectively grants an unauthenticated user full administrative control over the router once they possess the extracted credentials. With access to the admin panel, an attacker can reconfigure firewall rules, redirect traffic through malicious DNS servers, install persistent backdoors or malware such as botnet agents, and monitor all network traffic passing through the device. This compromises not only the integrity of the local network but also potentially exposes connected devices to further exploitation. In enterprise environments, this could lead to lateral movement across internal networks, while in residential settings it may result in privacy violations, bandwidth theft, or use of the compromised router as a pivot point for attacks against other internet-facing services.
To mitigate this risk, immediate action is required by updating the firmware on all affected PG5298A and PG5298B devices to version 3.0.82 for model A and version 4.0.82 for model B, where the vendor has addressed the access control deficiencies. Administrators should also change default passwords if they have not already done so, although this is secondary to patching since the vulnerability allows extraction of existing credentials regardless of their complexity. Network segmentation strategies can further limit exposure by restricting management interfaces from untrusted networks or DMZ zones. Additionally, deploying intrusion detection systems that monitor for unusual HTTP requests targeting administrative endpoints may provide early warning indicators of exploitation attempts before successful compromise occurs.