Backup Functionality Vulnerability in Kaon AR2140X Router
CVE-2026-52748

7.1HIGH

Key Information:

Vendor

Kaon

Status
Ar2140
Vendor
CVE Published:
28 September 2026

What is CVE-2026-52748?

The Kaon AR2140X router has a significant security flaw in its backup functionality, which can be exploited by an unauthenticated remote attacker. This vulnerability allows the attacker to access the router's configuration backup without needing proper authentication. The backup is encrypted with a device-specific key, and triggering this unauthorized access can render the router inoperable for an extended period. Firmware versions up to 4.2.17 are affected, with the status of updates beyond this version remaining uncertain.

Affected Version(s)

AR2140 0 <= 4.2.17

References

https://cert.pl/en/posts/2026/09/CVE-2026-52748
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sebastian Jeż
.