CVE-2024-3659CWE-78
Command injection in KAON AR2140 routers
Critical · published August 8, 2024
What it is
Firmware in KAON AR2140 routers, prior to versions 3.2.50 and 4.2.16, is vulnerable to a shell command injection via sending a crafted request to one of the endpoints.
In order to exploit this vulnerability, one has to have access to the administrative portal of the router.
The record
Technical detail
- CVSS v4.0
- 10.0 · CRITICAL
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- EPSS
- 0.01612 · 75.8th percentile
- Weakness
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- Published
- 2024-08-08T12:24Z
EPSS history
Timeline