PT-2024-27087 · Kaon · Kaon Ar2140

Arkadiusz Maruszczak · Published 2024-08-08 · Updated 2025-11-17 · CVE-2024-3659

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions KAON AR2140 routers versions prior to 4.2.16

Description The issue is related to a shell command injection vulnerability. It can be exploited by sending a crafted request to one of the endpoints, but access to the administrative portal of the router is required.

Recommendations For versions prior to 4.2.16, update to version 4.2.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the administrative portal to minimize the risk of exploitation.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2024-3659

Affected Products

Kaon Ar2140

References · 9

• https://osv.dev/vulnerability/CVE-2024-3659 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3659 · Security Note
• https://cert.pl/posts/2024/08/CVE-2024-3659 · Note
• https://cert.pl/en/posts/2024/08/CVE-2024-3659 · Note
• https://t.me/cveNotify/137289 · Telegram Post
• https://twitter.com/cracbot/status/1823238117815668750 · Twitter Post
• https://t.me/cvedetector/2790 · Telegram Post
• https://t.me/cvenotify/89916 · Telegram Post
• https://t.me/cveNotify/143071 · Telegram Post