CVE-2025-63080 Overview
CVE-2025-63080 is an authorization flaw [CWE-863] in the firmware of KAON PG5298A and PG5298B routers. Authenticated users can send crafted JSON-RPC requests to invoke privileged operations that the graphical user interface (GUI) does not expose. Exploitation allows arbitrary system file reads and operating system command execution on affected devices. KAON has released firmware version 3.0.82 for PG5298A and 4.0.82 for PG5298B to remediate the flaw. CERT Poland coordinated disclosure and published technical analysis of the issue.
Critical Impact
An authenticated adjacent-network attacker can execute operating system commands and read arbitrary files on the router, undermining the confidentiality, integrity, and availability of the device.
Affected Products
- KAON PG5298A router firmware prior to 3.0.82
- KAON PG5298B router firmware prior to 4.0.82
- Deployments exposing the JSON-RPC management interface to authenticated users
Discovery Timeline
- 2026-08-24 - CVE-2025-63080 published to the National Vulnerability Database (NVD)
- 2026-08-24 - Last updated in NVD database
Technical Details for CVE-2025-63080
Vulnerability Analysis
The vulnerability is an incorrect authorization issue [CWE-863] in the router's JSON-RPC management endpoint. The firmware authenticates the caller but does not enforce equivalent authorization on the full set of remote procedure calls that the backend exposes. Operations that the GUI intentionally omits remain reachable if an authenticated user submits a directly crafted JSON-RPC body.
An attacker with valid credentials can invoke privileged methods to read system files and execute operating system commands on the underlying router firmware. Because the router runs the management daemon with elevated privileges, command execution grants control over networking, credentials, and traffic passing through the device. The attack requires adjacent network access to the router's management plane, such as Wi-Fi or the LAN segment.
Root Cause
The firmware relies on GUI-side restrictions rather than backend authorization checks on the JSON-RPC dispatcher. The dispatcher accepts method names and parameters that expose privileged system functions to any authenticated session, regardless of the account's intended role.
Attack Vector
An authenticated user on the adjacent network sends a crafted JSON-RPC request to the router's management interface. The request specifies a method not surfaced by the GUI, such as a file-read or command-execution primitive, along with attacker-controlled parameters. The backend processes the call without verifying whether the caller is authorized for the requested operation. See the CERT Poland CVE-2025-63080 Analysis for the specific method names and payload structure.
Detection Methods for CVE-2025-63080
Indicators of Compromise
- Unexpected JSON-RPC requests to the router management endpoint referencing methods not used by the GUI workflow.
- Router log entries showing file reads outside the standard configuration paths or shell command invocations by the management daemon.
- New or modified accounts, altered DNS settings, or unexpected firewall rules on affected KAON PG5298A/B devices.
Detection Strategies
- Inspect HTTP/HTTPS traffic to the router management interface for JSON-RPC bodies invoking privileged methods on PG5298A and PG5298B firmware.
- Correlate authenticated management sessions with subsequent configuration changes to identify sessions performing actions unreachable from the GUI.
- Alert on outbound connections initiated from the router itself, which can indicate post-exploitation command execution.
Monitoring Recommendations
- Forward router syslog and management-plane access logs to a centralized log platform for retention and analysis.
- Baseline normal JSON-RPC method usage per administrator account and flag deviations.
- Monitor firmware version reporting to confirm affected devices have been upgraded to 3.0.82 or 4.0.82.
How to Mitigate CVE-2025-63080
Immediate Actions Required
- Upgrade KAON PG5298A devices to firmware 3.0.82 and PG5298B devices to firmware 4.0.82.
- Rotate all router administrative and user credentials after upgrading.
- Restrict access to the router management interface to trusted administrative hosts only.
Patch Information
KAON has released fixed firmware: version 3.0.82 for PG5298A and version 4.0.82 for PG5298B. Refer to the CERT Poland CVE-2025-63080 Analysis for coordinated disclosure details and vendor references.
Workarounds
- Disable remote management and confine administrative access to a dedicated management VLAN.
- Reduce the number of authenticated user accounts on the router and enforce strong, unique passwords.
- Segment guest and untrusted Wi-Fi networks from the router management interface to eliminate adjacent-network exposure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
