CVE-2026-52749

Name of the Vulnerable Software and Affected Versions Kaon AR2140X versions prior to 4.2.18

Description The router improperly issues session cookies in responses to unauthenticated HTTP requests. This allows a remote attacker to obtain a valid session identifier without providing credentials, leading to an authentication bypass. An attacker can use this access to perform unauthorized actions on upgrade-related functionalities, which can be further abused to force the router to issue GET requests to arbitrarily chosen domains.

Recommendations Update the firmware to a version newer than 4.2.17.