Vulnerabilities in Kaon AR2140 routers

CERT Polska published coordinated advisories for two Kaon AR2140 router flaws on 2026-09-28, both present in every firmware release through 4.2.17 with newer builds unverified by the vendor. CVE-2026-52748, CWE-306, exposes the backup function without authentication: an attacker triggers a configuration backup and retrieves it encrypted under a device-specific key, and triggering the function renders the router inoperable for a substantial period of time. CVE-2026-52749, CWE-287, is an authentication bypass: the router issues session cookies in responses to unauthenticated HTTP requests, and such a session can drive upgrade-related functionality, including forcing the router to issue GET requests to attacker-chosen domains. ENISA's EUVD-2026-88246 carries CVSS v4.0 7.1 for the first bug, NVD scores the second at 5.3, and both CVEs credit Sebastian Jeż's responsible report with CERT-PL as the assigning CNA.

The detail the feed dropped is the attack vector. Both CVSS v4.0 vectors read AV:A, adjacent network, so the scored attacker is already on the customer's LAN or Wi-Fi, a compromised laptop, an abused guest network, a rogue device, not a random internet scanner, despite the advisory's "unauthenticated remote attacker" phrasing. That reframes the exposure for ISP-managed fleets like Kaon's, where households cannot patch themselves and the router is the default gateway: one infected host on a flat home or SOHO network can pull a device-key-encrypted configuration dump, hold a valid admin session, and turn the gateway into a request proxy through the forced-GET primitive, reaching other devices on the same segment from a position no endpoint agent watches. The high availability impact on CVE-2026-52748 adds a one-request link killer, and multiplied across subscribers that is a fleet-scale outage primitive in a single packet.

Containment, not patching, is the current control, because no fixed firmware above 4.2.17 is confirmed as of 2026-09-28. Verify that AR2140 management surfaces are reachable only from the LAN segment they serve, and treat WAN-blocked management as necessary but insufficient against an adjacent attacker: segment guest Wi-Fi away from the LAN, and ask the ISP for a firmware commitment in writing. Hunt for the two signatures this bug class leaves: HTTP responses to requests that presented no credentials but set a session cookie on the router's management interface, and outbound GETs from the router itself to domains that are not the ISP's upgrade servers. Any triggered backup is attacker activity until proven otherwise, so an unexplained backup event followed by a router hang or reboot on an AR2140 warrants incident review.

Two developments would change this assessment. A firmware release above 4.2.17 confirmed by Kaon or a shipping ISP would move the response from containment to a patch race with a measurable end. Public proof-of-concept code or scanning telemetry against the backup or session endpoints would move exploitation from theoretical to observed, and if analysis of the device-specific backup key shows it derivable from device attributes, the encrypted configuration dump becomes a credential disclosure, pushing practical severity above the published 7.1.