Hard-Coded Credentials Vulnerability in KAON Routers
CVE-2025-7072

9.3CRITICAL

Key Information:

Vendor

Kaon

Status
Cg3000t
Cg3000tc
Vendor
CVE Published:
9 January 2026

What is CVE-2025-7072?

The firmware of the KAON CG3000TC and CG3000T routers contains hard-coded credentials in clear text that are shared across all devices of this model. This significant security oversight enables an unauthenticated remote attacker to leverage these credentials, gaining root access and executing commands on the routers. Users are strongly urged to update their firmware to the latest versions (1.00.67 for CG3000TC and 1.00.27 for CG3000T) to mitigate potential exploitation of this vulnerability.

Affected Version(s)

CG3000T 0 < 1.00.27

CG3000TC 0 < 1.00.67

References

https://cert.pl/posts/2026/01/CVE-2025-7072/
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Piotr Ługowski
.