Security readout for executives and security teams
Plain-English summary
An authenticated attacker on an adjacent network could abuse hidden router management functions to read system files or run commands. Successful exploitation could compromise the router’s confidentiality, integrity, and availability. The issue affects KAON PG5298A and PG5298B firmware and is fixed in the specified firmware releases.
Executive priority
Prioritize affected routers because successful exploitation provides command execution and system-file access. Accelerate remediation for devices on shared, hostile, or weakly controlled networks. Confirm upgrade ownership with the network provider, as router firmware may be operator-managed.
Technical view
Crafted JSON-RPC requests can bypass intended GUI restrictions because backend authorization is insufficient (CWE-863). Exploitation requires high privileges and adjacent-network access, but no user interaction. The CVSS 4.0 score is 8.5. Fixed versions are 3.0.82 for PG5298A and 4.0.82 for PG5298B.
Likely exposure
Exposure is most likely where PG5298A or PG5298B management services are reachable from adjacent networks and devices lack the fixed firmware. The supplied version data does not clearly enumerate every vulnerable release, so organizations should confirm applicability with KAON or their service provider.
Exploitation context
The supplied sources do not report active exploitation, and the CVE is not identified as CISA KEV. Exploitation nevertheless requires an authenticated, highly privileged user with adjacent-network access, reducing reachability but making compromised administrator credentials or hostile local networks relevant threat paths.
Researcher notes
The authorization weakness exposes JSON-RPC operations unavailable through the GUI. CVSS 4.0 indicates adjacent access, low complexity, high privileges, no interaction, and high device impact without subsequent-system impact. The bundle identifies fixed releases but does not provide a complete vulnerable-version range or evidence of exploitation in the wild.
Mitigation direction
- Upgrade PG5298A devices to firmware 3.0.82 or later, subject to vendor confirmation.
- Upgrade PG5298B devices to firmware 4.0.82 or later, subject to vendor confirmation.
- Restrict router management access to trusted administrative networks and authorized personnel.
- Review vendor or service-provider guidance where firmware updates are centrally managed.
- Rotate administrative credentials if compromise is suspected.
Validation and detection
- Inventory KAON PG5298A and PG5298B routers and record installed firmware versions.
- Confirm PG5298A devices report firmware 3.0.82 or a vendor-confirmed later release.
- Confirm PG5298B devices report firmware 4.0.82 or a vendor-confirmed later release.
- Verify management interfaces are inaccessible from untrusted or unnecessary adjacent networks.
- Review authentication and management logs for unexplained privileged activity, where available.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-63080 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.5 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——CERT-PLVulnerability scoring details
Base CVSS 4.0 score
8.5HighVector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://cert.pl/en/posts/2026/08/CVE-2025-63080/CVE reference, CERT-PL · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Authorization
Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.