This issue was identified in firmware versions up to 4.2.17. Status of newer versions remains unknown.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Kaon | AR2140 | unknown |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://cert.pl/en/posts/2026/09/CVE-2026-52748 |
|
Mon, 28 Sep 2026 13:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Kaon AR2140X router contains a vulnerability where the backup functionality is accessible without authentication. This allows an unauthenticated remote attacker to trigger a configuration backup and retrieve it in a form encrypted by a device-specific key. Triggering this function renders the router inoperable for a substantial period of time. This issue was identified in firmware versions up to 4.2.17. Status of newer versions remains unknown. | |
| Title | Missing authentication for backup functionality in Kaon AR2140X | |
| First Time appeared |
Kaon
Kaon ar2140 |
|
| Weaknesses | CWE-306 | |
| CPEs | cpe:2.3:a:kaon:ar2140:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Kaon
Kaon ar2140 |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: CERT-PL
Published:
Updated: 2026-09-28T13:31:27.461Z
Reserved: 2026-06-08T14:40:31.449Z
Link: CVE-2026-52748
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-28T13:17:21.847
Modified: 2026-09-28T13:17:21.847
Link: CVE-2026-52748
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-306
Missing Authentication for Critical Function